Date: 12/15/05 (Apache)    Keywords: apache

I have a developer at the office, who's trying to send files via a Perl module for creating Excel spreadsheets through an SSL site. Smaller files seem to work fine. But the second a file that's around a meg or so gets generated? It "times out" at 64k. He is *convinced* this is an Apache issue. We're using, as far as I know, stock Apache on OS/X Tiger 10.4.2.

What caveats should I be looking for in the configuration files? Apparently the perl developer of the module is convinced it's not his issue, as he has OS/X, same version, and it works fine. The developer is pulling his hair out over this. Nothing, that I can see, in the conf file, looks wrong or weird, so I figured maybe someone here might have a clue as to what may be going on?

Thanks in advance!

Source: http://www.livejournal.com/community/apache/28767.html

Date: 12/15/05 (Apache)    Keywords: web, google, apache

Ok, I got the virtual hosts working. Now I'm wanting to set up a secure server. I've tried google and the apache website, and it's all seeming rather confusing and beyond what I need. I'm not worried about things like man in the middle attacks or anything like that, so certificates arn't needed. All I want to do is make a site encrypted, basicly https.

How do I go about doing this?

Source: http://www.livejournal.com/community/apache/28492.html

Date: 12/16/05 (Java Web)    Keywords: html, web, apache

A cross-site scripting (XSS) vulnerability has been discovered in the Apache httpd server's mod_imap module which allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps. Input passed to the image map "Referer" directive in "mod_imap" isn't properly sanitised before being returned to the user. This can be exploited [...]

Source: http://blog.taragana.com/index.php/archive/cross-site-scripting-vulnerability-in-apache-mod_imap-module/

Date: 12/29/05 (PHP Community)    Keywords: php, html, security, web, linux, apache

Greetings all, new reader on the community here.

I'm one of the co-administrators of a small private co-op site, and we recently had our webserver hacked. :( We're still trying to figure out why, but there is some suspicion that PHP vulnerabilities might have been the vector of attack. As a result I am planning to upgrade to the latest and greatest version of PHP, but before we go live again with that, I want to review the PHP that runs on a few sites we host and make sure that I've taken care of as many holes as reasonably possible.

We run Debian Linux, and I've just upgraded us to Apache 2.0 as well. (We plan to upgrade to 2.2 as soon as we have a Debian package for that.) And I plan to put PHP 5.0.5 up off of backports.org.

The questions I would like to pose to the community are:

1) Since PHP 5.1.1 is not available in package form yet, are there any known big problems with 5.0 that might make it necessary for me to build 5.1.1 by hand?

2) I've been reading up in the Security chapter of the docs on php.net, as well as the SecurePHP wiki, and have come up with a list of things I know I'd like to look at. Can anyone recommend things besides these items that I ought to look at?

- Use .htaccess to control who gets to look at source code
- Take sensitive data, e.g., passwords, out of public web space
- Verify that register_globals is OFF
- Validate all user data
- Initialize variables
- Turn off magic quotes
- Use addslashes and stripslashes as needed
- Set expose_php = off in php.ini
- Log errors out to files not in public space rather than displaying them on the page
- Use $_POST, $_GET, $_COOKIE, and $_SESSION for global variables
- Use htmlspecialchars() for hidden form values
- For URL stuff, use both htmlspecialchars() AND urlencode(); the latter should be for specific variables in the URL, and the former for the entire URL

Thank you very much in advance for any pointers!

Source: http://www.livejournal.com/community/php/384514.html

Date: 01/03/06 (Java Web)    Keywords: web, apache

In the new year lets look back to Apache Harmony, the much publicised effort to create "open source" J2SE announced in early May last year. After eight months there is still nothing to show, no downloads. The website is sparsely populated. Only four contributors are listed (where is the fulltime IBM employee?). The only recognizable company [...]

Source: http://blog.taragana.com/index.php/archive/apache-harmony/

Date: 01/09/06 (PHP Community)    Keywords: php, google, apache

Im having a horrible experience upgrading php from 4.4.1 to 5.0.5. Im on a lamp server and its got apache 1.3 running on it, every time i try to upgrade php, "BAM!", httpd fails and i have to revert back to 4.4.1. I havnt a clue on how to fix this problem and i can't seem to find anything on google about it. If you have any ideas please help!

Thanks in advance!

Source: http://www.livejournal.com/community/php/390879.html

Date: 01/09/06 (Asp Dot Net)    Keywords: web, apache

At my job we seem to not have the most competant IT department, so in my effort to help rather than criticize I'm looking into ways to help them out. One of the problems that they seem to have is that their web server (which I'm assuming has IIS 6, or maybe 5) will get bogged down to the point where it has to be rebooted. They host a mix of .NET and Frontpage pages. I seriously doubt that this is how things are "supposed" to be, because then Apache would have a great ace in the hole. Anyways since I'm not very good at server administration (and apparently neither are these guys) is there anything any of you can think of that would cause such problems? It seems like there's a problem with resources not being freed up or something along those lines. If anyone has any ideas/experiences with this it would be appreciated. Thank you.

Source: http://www.livejournal.com/community/aspdotnet/52938.html

Date: 01/09/06 (Computer Geeks)    Keywords: web, apache

At my job we seem to not have the most competant IT department, so in my effort to help rather than criticize I'm looking into ways to help them out. One of the problems that they seem to have is that their web server (which I'm assuming has IIS 6, or maybe 5) will get bogged down to the point where it has to be rebooted. They host a mix of .NET and Frontpage pages. I seriously doubt that this is how things are "supposed" to be, because then Apache would have a great ace in the hole. Anyways since I'm not very good at server administration (and apparently neither are these guys) is there anything any of you can think of that would cause such problems? It seems like there's a problem with resources not being freed up or something along those lines. If anyone has any ideas/experiences with this it would be appreciated. Thank you.

Source: http://www.livejournal.com/community/computergeeks/855580.html

Date: 01/11/06 (Apache)    Keywords: apache

Hey all :)

I was wondering if clients maintain an active connection to apache as long as they are viewing the hosted site.
More specifically, does Apache know when a client leaves the site, either through sudden connection failure, or change of browsing direction?

Any insight would be much appreciated.

Thanks in advance.

Source: http://www.livejournal.com/community/apache/29330.html

Date: 01/11/06 (Apache)    Keywords: apache

Can I have an Apache1/mod_perl1 installation coexisting with an Apache2/mod_perl2 installation?

Source: http://www.livejournal.com/community/apache/28932.html

Date: 01/17/06 (WebDesign)    Keywords: php, programming, mysql, database, sql, java, postgresql, web, apache

I need some advice in regard to which language to use for developing a dynamic website. My wife and I are thinking about creating a LMAO website, which will allow people to organize various LMAO projects. The website will allow users to register, log in, create projects, join projects, upload pictures, and so on. It's not terribly large project, but still pretty complicated for people who haven't done any web development and little programming in general.

The first problem is deciding upon a language to use. The site will, at least in the beginning, run on our server at home, which is FreeBSD running Apache2 (or anything else we want, to be honest. I'm not giving up FreeBSD, though!). It looks like all major languages in the field, including PERL, Ruby (and Ruby on Rails), Python, and PHP work well with Apache, so that shouldn't be a problem. For the database back-end, we'll be using PostgreSQL or MySQL (if we have to), both of which are widely supported as well.

My wife doesn't have much experience in programming, so for her it will be new experience one way or the other. I have some, but still little. The only language I'm familiar with and can actually write something useful in is Common Lisp. There exists mod_lisp and a couple of web development frameworks, TBNL and UnCommon Web, but the process seems hacky -- from what I can tell -- unless one uses a commercial CL implementations that cost a lot.

I've looked briefly at Python and Ruby, as well as asked for opinions from various groups of people (programmers who prefer Lisp, Ruby, or Python), but it's all still looks like mambo-jumbo to me. The only thing they agree on is that one should refrain from using PHP for anything non-trivial, so I'm inclined to believe that. As far as PERL is concerned, I've always had a distaste for it, so am not all that keen on using it.

Could anyone recommend one of these language, or perhaps another one, that would be suitable for our needs? I've pretty much made up my mind in regards to PHP and PERL, so I'm not looking for a debate about why they're good. I also wish to stay away from Windows-based and Java-based solutions.

Source: http://www.livejournal.com/community/webdesign/1045210.html

Date: 01/11/06 (Apache)    Keywords: apache

Hey all :)

I was wondering if clients maintain an active connection to apache as long as they are viewing the hosted site.
More specifically, does Apache know when a client leaves the site, either through sudden connection failure, or change of browsing direction?

Any insight would be much appreciated.

Thanks in advance.

Source: http://community.livejournal.com/apache/29330.html

Date: 01/11/06 (Apache)    Keywords: apache

Can I have an Apache1/mod_perl1 installation coexisting with an Apache2/mod_perl2 installation?

Source: http://community.livejournal.com/apache/28932.html

Date: 12/15/05 (Apache)    Keywords: apache

I have a developer at the office, who's trying to send files via a Perl module for creating Excel spreadsheets through an SSL site. Smaller files seem to work fine. But the second a file that's around a meg or so gets generated? It "times out" at 64k. He is *convinced* this is an Apache issue. We're using, as far as I know, stock Apache on OS/X Tiger 10.4.2.

What caveats should I be looking for in the configuration files? Apparently the perl developer of the module is convinced it's not his issue, as he has OS/X, same version, and it works fine. The developer is pulling his hair out over this. Nothing, that I can see, in the conf file, looks wrong or weird, so I figured maybe someone here might have a clue as to what may be going on?

Thanks in advance!

Source: http://community.livejournal.com/apache/28767.html

Date: 12/15/05 (Apache)    Keywords: web, google, apache

Ok, I got the virtual hosts working. Now I'm wanting to set up a secure server. I've tried google and the apache website, and it's all seeming rather confusing and beyond what I need. I'm not worried about things like man in the middle attacks or anything like that, so certificates arn't needed. All I want to do is make a site encrypted, basicly https.

How do I go about doing this?

Source: http://community.livejournal.com/apache/28492.html

Date: 12/13/05 (Apache)    Keywords: virus, web, google, apache

Hello, I just joined this fine community...actually it's quite an amazing coincidence that I found it right when my Apache server is having terrible problems.
I haven't had problems with it up until recently, but lately it has just been really misbehaving on me! Normally I have one of my friends help me with it but he's really busy so hopefully someone here can be of service.

Here it goes:

I got a new computer (an emachine with Windows xp Media Edition) a few months ago and ran Apache on it just perfectly. I was all set to start working on a new layout for my web page when something weird happened with Comcast: they actually kicked me offline for having a virus! I never knew comcast could do that...so I had to go to Best Buy where they swept my entire computer clean and reinstalled all the things the machine came with. Luckily I had back up files of most of my pics and such...but not of Apache of course.

So I had to re-install Apache from its website. This is around where the trouble started.
When I re-installed it, I followed the guidelines that my friend (who has always helped in the past) had written down for me in previous emails. I had saved the emails so that I could refer to them later in case of such things.
I installed Apache 2.0.55, or as the actual file is read: apache_2.0.55-win32-x86-no_ssl.msi to my desktop and then ran the file.
I typed in my information correctly (I even double and triple checked that!), and then continued to install...and Apache ran perfectly fine.

Then, of course, I had to go to the C:\Program Files\Apache Group\Apache2\conf file and modify the httpd.conf file. I copy and pasted what was in an email I received from my friend, which has always been correct in the past and which, previously, I have had NO problem with AT ALL.

However, when I restarted Apache, I got the following message: "The requested operation has failed!"
It hasn't started since then. *cries*

I have tried to do the following to remedy (and possibly understand) what is going on:

1. I tested the Apache Server Configuration
when I did this, it said that there was an error on line 15 of the httpd.conf file. I checked line 15 and didn't see anything out of order, but I was also unsure of what I was looking for, so that didn't much help.

2. I checked the Error Log File
when I did this, this message (among message that were not errors or problems) came up:
[Mon Dec 12 17:29:28 2005] [warn] (OS 995)The I/O operation has been aborted because of either a thread exit or an application request. : winnt_accept: Asynchronous AcceptEx failed.

What exactly does this mean? I had no clue...

3. I searched for the words "Asynchronous AcceptEx" on google and came up with a few sites that I thought might explain what was going on, but mostly they were just a bunch of people talking about similar problems, rather than a solution to the problem.


Sooo...I still remain lost and need help!
If anyone knows anything about this or has suggestions please let me know. This has been going on for about a month now and I am not a person with money (being a college kid and all), so I can't just have my domain name sit here being unused.
:(

Thanks to anyone who can help me!

Source: http://community.livejournal.com/apache/27907.html

Date: 12/06/05 (Apache)    Keywords: apache

Now that Apache 2.2 is out with AJP support built in, should I use it or continue using mod_jk? What's the difference? What are the benefits either way?

Any info appreciated. I'm just working on setting up Apache+JOnAS now, and I'd like to launch with the most current version.

x-posted

Source: http://community.livejournal.com/apache/27837.html

Date: 12/04/05 (Apache)    Keywords: php, html, web, yahoo, google, apache

I am beginning to work on multiple sites on my home test server and need to set up virtual hosts. 

My server is running SuSE 10 with Apache 2, and is accessed by typing in "talon" in firefox's address bar.  I copied vhosts.template to site1.conf and edited it as follows:

# # VirtualHost template # Note: to use the template, rename it to /etc/apache2/vhost.d/yourvhost.conf. # Files must have the .conf suffix to be loaded. # # See /usr/share/doc/packages/apache2/README.QUICKSTART for further hints # about virtual hosts. # # Almost any Apache directive may go into a VirtualHost container. # The first VirtualHost section is used for requests without a known # server name. # <VirtualHost *:80>     ServerAdmin deathrockadrya@yahoo.com     ServerName site1.talon     # DocumentRoot: The directory out of which you will serve your     # documents. By default, all requests are taken from this directory, but     # symbolic links and aliases may be used to point to other locations.     DocumentRoot /srv/www/vhosts/site1     # if not specified, the global error log is used     ErrorLog /var/log/apache2/site1     # CustomLog /var/log/apache2/site1      # don't loose time with IP address lookups     HostnameLookups Off     # needed for named virtual hosts     UseCanonicalName Off     # configures the footer on server-generated documents     ServerSignature On     # Optionally, include *.conf files from /etc/apache2/conf.d/     #     # For example, to allow execution of PHP scripts:     #     # Include /etc/apache2/conf.d/mod_php4.conf     #     # or, to include all configuration snippets added by packages:     # Include /etc/apache2/conf.d/*.conf     # ScriptAlias: This controls which directories contain server scripts.     # ScriptAliases are essentially the same as Aliases, except that     # documents in the realname directory are treated as applications and     # run by the server when requested rather than as documents sent to the client.     # The same rules about trailing "/" apply to ScriptAlias directives as to     # Alias.     #     ScriptAlias /cgi-bin/ "/srv/www/vhosts/site1/cgi-bin/"     # "/srv/www/cgi-bin" should be changed to whatever your ScriptAliased     # CGI directory exists, if you have one, and where ScriptAlias points to.     #     <Directory "/srv/www/vhosts/site1/cgi-bin">         AllowOverride None         Options +ExecCGI -Includes         Order allow,deny         Allow from all     </Directory>     # UserDir: The name of the directory that is appended onto a user's home     # directory if a ~user request is received.     #     # To disable it, simply remove userdir from the list of modules in APACHE_MODULES     # in /etc/sysconfig/apache2.     #     <IfModule mod_userdir.c>         # Note that the name of the user directory ("public_html") cannot simply be         # changed here, since it is a compile time setting. The apache package         # would have to be rebuilt. You could work around by deleting         # /usr/sbin/suexec, but then all scripts from the directories would be         # executed with the UID of the webserver.         UserDir public_html         # The actual configuration of the directory is in         # /etc/apache2/mod_userdir.conf.         Include /etc/apache2/mod_userdir.conf         # You can, however, change the ~ if you find it awkward, by mapping e.g.         # http://www.example.com/users/karl-heinz/ --> /home/karl-heinz/public_html/         #AliasMatch ^/users/([a-zA-Z0-9-_.]*)/?(.*) /home/$1/public_html/$2     </IfModule>     #     # This should be changed to whatever you set DocumentRoot to.     #     <Directory "/srv/www/vhosts/site1">             #         # Possible values for the Options directive are "None", "All",         # or any combination of:         #  Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews         #         # Note that "MultiViews" must be named *explicitly* --- "Options All"         # doesn't give it to you.         #         # The Options directive is both complicated and important.  Please see         # http://httpd.apache.org/docs-2.0/mod/core.html#options         # for more information.         #         Options Indexes FollowSymLinks             #         # AllowOverride controls what directives may be placed in .htaccess files.         # It can be "All", "None", or any combination of the keywords:         #  Options FileInfo AuthConfig Limit         #         AllowOverride None             #         # Controls who can get stuff from this server.         #         Order allow,deny         Allow from all         </Directory> </VirtualHost>

Next I opened /etc/hosts and edited as follows:

# # hosts        This file describes a number of hostname-to-address #              mappings for the TCP/IP subsystem.  It is mostly #              used at boot time, when no name servers are running. #              On small systems, this file can be used instead of a #              "named" name server. # Syntax: #    # IP-Address  Full-Qualified-Hostname  Short-Hostname # 127.0.0.1        localhost 127.0.0.1        site1      site1.talon 127.0.0.1        site2      site2.talon 127.0.0.1        site3      site3.talon

Then, rcrestart apache2.... ok.

And here is where I am stumped..  (and btw I googled the bit about /etc/hosts - i'm not sure if that's how it should be).    If I type in http://talon/site1 Apache says page can't be found.  If I try http://site1 page can't be found.    My site1 files exist in the DocumentRoot listed in the site1.conf file above. 

I also read through apache's documentation on virtual hosts but the way they explained it didn't make as much sense to me. 

Thanks for any and all help.. I've wanted to learn vhosts for some time now. 

Source: http://community.livejournal.com/apache/27604.html

Date: 11/29/05 (Apache)    Keywords: apache

Can anyone point me to a good tutorial on how to setup and use Apache2 as a reverse proxy? I need to run an Apache1 instance for some legacy Perl stuff that's not upgraded for Ap2, but most of my sites are currently quite happy with Ap2. I'd like to know if (and how) I can run Ap1 on a different port of the same box but have that be completely transparent to any visitors, thanks to the reverse proxy. Ideally I could have Ap2 serve the static files (images, stylesheets) for this legacy site, but if Ap1 has to do it all (for that site) that's fine. From the reading I've done it seems I'll need to use mod_rewrite to do this, but that scares me a bit, as it seems very complex.

Source: http://community.livejournal.com/apache/27219.html

Date: 11/26/05 (Apache)    Keywords: apache

This has annoyed me for a while and need your help.

apache2 install on debian.

In /etc/apache2/sites-available I have two files which has this:

< = [ and > = ]

file1

NameVirtualHost 12.34.56.789
Options +ExecCGI

[VirtualHost www.adomain1.com]
DocumentRoot /home/domains/adomain1.com/www
ServerName www.adomain1.com
ErrorLog /home/domains/adomain1.com/logs/www-error.log
CustomLog /home/domains/adomain1.com/logs/www-access.log combined
[/VirtualHost]

[VirtualHost adomain1.com]
DocumentRoot /home/domains/adomain1.com/www
ServerName adomain1.com
ErrorLog /home/domains/adomain1.com/logs/www-error.log
CustomLog /home/domains/adomain1.com/logs/www-access.log combined
[/VirtualHost]

file2

[VirtualHost www.adomain2.com]
DocumentRoot /home/domains/adomain2.com/www
ServerName www.adomain2.com
ErrorLog /home/domains/adomain2.com/logs/www-error.log
CustomLog /home/domains/adomain2.com/logs/www-access.log combined
[/VirtualHost]

[VirtualHost adomain2.com]
DocumentRoot /home/domains/adomain2.com/www
ServerName adomain2.com
ErrorLog /home/domains/adomain2.com/logs/www-error.log
CustomLog /home/domains/adomain2.com/logs/www-access.log combined
[/VirtualHost]

When I start apache, I get this error message:

[Sat Nov 26 15:44:46 2005] [warn] VirtualHost www.domain1.com:0 overlaps with VirtualHost www.domain2.com:0, the first has precedence, perhaps you need a NameVirtualHost directive

I use one IP address to hold more than one domain.

When I remove the bits that doesn't have the 'www' entry, it works fine. But I don't want that as people who go to a site without the 'www' bit will be redirected to a different page.

Is there any easier way to do this - getting people to visit the same, via http://www.adomain1.com and http://adomain1.com to one page and http://www.adomain2.com and http://adomain2.com to another page?

Thanks.

Source: http://community.livejournal.com/apache/27109.html