BlaM's questions

I'm just getting started with Docker and richt now I'm trying to figure out how to set up my first dockerized Apache 2 / PHP environment. Up to now I have been using full Linux VMs, where I used log-files being written to /var/log/apache2, then use "logrotate" to hop to a new file each day.

Logfiles were mainly used for immediate error detection (i.e. log on to the server and use less to open the current access.log and error.log files) and for fail2ban.

If I'm correct that is not practicable in an Docker environment - mainly because you usually cannot log in to containers to have a look at the logs. Also logs will be lost if the container is removed.

So: What is the most common method to work with/emulate/replace access.log/error.log in that situation? What are common solutions for both production and development environments?

My ideas so far include using a NFS share (slow and may cause filename collisions if not careful), and logstash (not sure if it is worth the effort and practicable for smaller sites or even dev environments?) but I'm sure smart people have come up with better solutions?

Not sure if it makes a difference, but currently I'm basing my Docker image on php:5.6-apache.

My setup:

• nginx is listening on port 80 and working as a reverse proxy (plus directly sending static files)
• Apache 2 is listening on port 8080
• PHP is running in Apache 2
• All running on one server (no internal network latency)

My problem:

Static files now are very fast, but everything going through the proxy takes a lot of extra time.

One example is a "search-as-you-type" tag suggestion box. When I connect to Apache directly though port 8080 everything is fine and the server responds quickly (~50 ms). When I use the "normal path" through port 80 (nginx -> Apache) every request takes about 15 times as long (~750 ms).

I expected some more time. Right now requests are not leaving the server in any way, so why do they take so much more time to process? How do I make them faster?

Is there any way I can use persistent connections between nginx and Apache?

Is there any way to benchmark where exactly that additional 0.7 second is added?

Main interest: Can I find out if this time comes from internal processing in nginx (e.g. hostname table lookup) or is it the connection to Apache. Is nginx waiting for an open socket - or what happens here?

I just tried to add a new fail2ban rule that is supposed to scan Apache2 error logs for suspicious file access attempts (People who try to access three common login urls that do not exist usually don't have good intentions).

To do so I added a new rule to my jail.local file:

[apache-suspiciousfiles]
enabled   = true
port      = http,https
filter    = apache-suspiciousfiles
banaction = iptables-allports
action    = %(action_mwl)s
logpath   = /var/log/apache2/error*.log
maxretry  = 3

That - however - gave me an unexpected error message in my logs:

2014-02-10 13:28:51,450 fail2ban.jail   : INFO   Jail 'apache-suspiciousfiles' started
2014-02-10 13:28:51,690 fail2ban.actions.action: ERROR  iptables -N fail2ban-apache-suspiciousfiles
iptables -A fail2ban-apache-suspiciousfiles -j RETURN
iptables -I INPUT -p tcp -j fail2ban-apache-suspiciousfiles returned 200

I had checked the filter with fail2ban-regex before that, so I was quite sure that it was not something in there.

(Note: This is "returned 200". Many people seem to have a problem with 100, but this is about 200)

Okay, this is slowly getting annoying. I'm used to work with Apache Webservers and never had any of these problems. IIS seems to try to be intelligent - or whatever.

Here's my situation: My customer wants a PHP website and it is supposed to run on an Windows IIS webserver.

For my development environment I could use my Apache - but just to be sure I want to do it with IIS, too. So I set up a dev-server with Windows Vista, all the latest Updates and installed IIS. Everything fine!

I quickly found instructions on how to install PHP in IIS on some official Microsoft site. Modified php.ini - have been doing stuff like that for years on Linux/Apache machines.

So now I have a Server to run IIS on and my workstation which I use to develop, accessing the files on the server over network.

My first "phpinfo()" page - everything okay. Now I intentionally break the page by introducing a bug: All I get on my workstation is "Server Error 500". When I access the page directly on the server I see an PHP error message... Well, got that worked out with this serverfault.com question.

BUT: It still keeps annoying me: Now if there is an error all I get is JUST the error message. I don't see any of the other output of the script. In fact in Firefox I don't see anything at all in case of an error.

For example if I do this...

<?PHP 
$sql = 'THIS WON\'T WORK';
echo $sql;
$DB->exec($sql);  // <- This causes an error
?>

all I get is

PHP Fatal error:  Call to a member function exec() on a non-object in C:\inetpub\wwwroot\phpinfo.php on line 4

What I actually want is that it shows me the output of everything that happened before the error so that I can use that to fix my problem.

How do I get IIS (or PHP?) to show me everything? Error message AND context? Over the network?

Update

Okay, I may have a lead. When I go to my console and call my script manually via php-cgi.exe this is what I get:

PHP Fatal error:  Call to a member function exec() on a non-object in C:\inetpub
\wwwroot\phpinfo.php on line 4
X-Powered-By: PHP/5.4.12
Content-type: text/html

THIS WON'T WORK<br />
<b>Fatal error</b>:  Call to a member function exec() on a non-object in <b>C:\i
netpub\wwwroot\phpinfo.php</b> on line <b>4</b><br />

I then tried to pipe the output to a files and figured out that the first two lines are piped to stderr and the rest goes to stdout (Read here for more info about that).

I can also see that what I get in my browser is the output to stderr, because it does not contain any HTML formatting.

I can now narrow my question down to this: I have a FastCGI PHP-CGI that outputs an error message to stderr and the page causing the error to stdout. It currently forwards stderr to the browser - how do I get it to use stdout instead?

I have a strange problem with Ansible that I use to install / update / manage my webservers.

I have an installation script that is supposed to make sure that I always have the latest PHP5 module in my Debian 6 / Apache 2 system:

  - name: install apache2 and php5
    action: apt pkg=$item state=latest
    with_items:
      - apache2
      - php5
      - libapache2-mod-php5
      - php5-curl
      [...]
    notify:
      - restart apache

It usually works great, but once every few runs I end up with mod-php5-filter in my apache instead of mod-php5 - which is bad for various reasons (mainly for breaking everything).

All I have to do then is run my installation script again - and I'm back to mod-php5

Any ideas? Anything that I might be doing wrong?

I'm currently experiencing a weird problem with one of my MySQL database servers:

It stopped asking for passwords when I try to access the database from local with the mysql command line tool.

I need a valid admin username. I also still need a password for remote access (i.e. from another IP). And I need a password when I - for example - access the database from a PHP script. But when I try to access the database from local host/commandline it will let me straight in to the data with my administrative users.

They (admin users) have passwords set - and as I mentioned - I still need to specify those when I try to access the data via PHP.

Changing the password didn't help.

Non-Administrative users need to specify their passwort, but that doesn't really help if they can get anywhere with "mysql -u root" (or another admin user account name).

(System Debian Linux Lenny, MySQL 5.0.51a)

Any ideas? Anything that explains this behaviour? I don't understand how this can happen.

Is it possible to have both windows authentication and basic authentication enabled on one .asmx page in IIS7?

What I want is:

• Someone calls webservice
• If possible, use windows authentication (e.g. when calling from another Microsoft based application)
• If the client doesn't know how to handle windows authentication: allow him to use basic authentication (for example when the client is a program that we can't really modify).
• If that still doesn't work, send a 401

It looks like - as soon as I enable windows authentication - all basic authentication attempts are ignored / answered with an 401, even though the login credentials worked before I enabled windows authentication.

I keep getting error messages like these on a server running an installation of an embedded Mongoose webserver

[1280931978] [error] [client 66.65.74.105] CCM_POST /ccm_system/request: Error 400: Bad Request
[1280931558] [error] [client 71.162.141.214] CCM_POST /ccm_system/request: Error 400: Bad Request

I figured out that CCM_POST seems to be some kind of HTTP command LIKE GET, POST, PUT and DELETE, but what is it supposed to do?

Is that some kind of vulnerability scan?

Is there a secret way to bind MySQL to more than one IP address?

As far as I can see the bind-address parameter in the my.cnf does not support more than one IP and you can't have it more than once.

I have an Apache 2 with mod_setenvif. My goal is to stop all hotlinking of images in my global apache.conf. Currently that's:

<FilesMatch ".(gif|jpg|jpeg|png)$">
    SetEnvIfNoCase Referer "^http://[^/]*blogger.com/" hotlink
    SetEnvIfNoCase Referer "^http://[^/]*myspace.com/" hotlink
    SetEnvIfNoCase Referer "^http://[^/]*ebay" hotlink
    ...
    deny from env=hotlink
</FilesMatch>

Works nicely so far, but I have to catch every hotlinker once and add it to my config. I would like to have a broader apprach by adding something like this:

    # Set variable "hotlink" if Referer contains "forum"
    SetEnvIfNoCase Referer "forum" hotlink

    # Unset variable if Referer is from the same Host as current request
    SetEnvIfNoCase Referer %{Host} !hotlink

The plan is to match http://evilhost.com/forum/, but not http://myhost.com/forum/.

The problem is that the latter unset does not work. Looks as if I can't use the header property "Host" as regexp pattern - at least not the way I tried to. Of course I could manually enter all possible hostnames in my config, but that's exactly what I want to avoid.

So my question is:

• Is there a way to use a HTTP header as regexp pattern at all?
• If not, do you know another way I could reach my goal to unset the variable "hotlink" if the referrer is from the same host?

In my Apache config I want to set an environment variable if I see that the visitor comes from an specific IP range. Currently I do it this way:

SetEnvIfNoCase Remote_Addr "^194\.8\.7[45]\." banned=spammer-ip
SetEnvIfNoCase Remote_Addr "^212\.156\.170\." banned=spammer-ip

What I would prefer is something like this:

SetEnvIfIpRange 194.8.74.0/23 banned=spammer-ip
SetEnvIfIpRange 212.156.170.0/24 banned=spammer-ip

... because I think that converting an IP address to a string and then do an regular expression is a total waste of ressources.

I could do an

Deny From 194.8.74.0/23

... but then I don't get a variable that I can check in my 403 error page - to find the reason why access has been denied.

Any suggestions what I might miss? Is there an Apache2 MOD that can set environment variables based on "IP Address Ranges"?

If I want to apply a rule to only some files in apache2.conf, I can use <FilesMatch>.

For example:

<FilesMatch ".(gif|jpg|jpeg|png|mpg|avi)$">
    deny from env=hotlink
</FilesMatch>

But is there a opposite to FilesMatch, i.e. a FilesNotMatch?

What I want to achieve is:

<FilesMatch ".(gif|jpg|jpeg|png|mpg|avi)$">
    <FilesNotMatch "ban">
        deny from env=hotlink
    </FilesNotMatch>
</FilesMatch>

(deny hotlinking of all images on a server BUT banners)

Or do you have a suggestion how I could modify my regexp to not match anything that contains "ban" ?

Is there any way to find out which application on a server is responsible for incoming traffic?

I have a debian linux server that has a lot of incoming traffic and would like to know if someone managed to hack his way into it or if there's a faulty web-application (apache2 + PHP) and I just have to fix a bug.

Any suggestions? Applications I need to know about? "Long Time Network Monitors"?

Is there something like mod_secdownload (which is available for lighttpd) also available for Apache 2.x?

The mod provides expiring URLs, so that it is possible to prevent hotlinking of files. A similar feature is used by Amazon S3.

The server application has to generate a hash with a secret code and an expiry timestamp so that URLs only live for a given duration of time.

The closest thing I could find is mod_auth_token, but that seems to be Apache 1.3 only.

Additional Hints:

• As suggested by HD: mod_auth_token works great with Apache 2.x
• If you need some hints on how to use it: Info Page at nixbit.com

I want to make an existing domain a "CDN" domain that serves all images, CSS and JS files (i.e. static files). However that domain was parked earlier and some application on that domain has set cookies.

As far as I can observe, I'd say that with cookies the "Expires" header doesn't seem to have much effect with some browsers (Including Firefox). The browsers still request the file, even if they shouldn't do so for the next month.

It would be possible to do some mod_rewrite tricks to detect if there are any cookies and then call a PHP file to remove the cookies and serve the static file so that for the next call there aren't any cookies left, but maybe you can give me a simpler method:

Is there a "Apache .htaccess only" way of removing all existing cookies?