Normally in my vhost blocks I do:
Define SITE example.com
SSLCertificateFile /path/to/${SITE}.crt
SSLCertificateKeyFile /path/to/${SITE}.key
I'm wondering if it's possible to create a variable in Apache that would correspond to my filenames for example.com.crt and example.com.key?
I assume not, but it's worth asking to consolidate my vhost blocks.
The %{REQUEST_FILENAME} contains a string like this:
/web/webroot/index.php
I see a lot of people recommend testing if a file exists and has a .php extension like this:
RewriteCond %{REQUEST_FILENAME}.php -f
Isn't the .php after %{REQUEST_FILENAME} redundant? The variable should already contain the .php, right?
Seems like adding .php after %{REQUEST_FILENAME} would make the TestString check add an extra .php, like this:
/web/webroot/index.php.php
I'm missing something simple, I'm sure of it, but I just don't know what it is.
The context is this:
RewriteCond %{THE_REQUEST} ^.*?\.php [NC]
RewriteRule ^ - [R=404,NE,L]
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^ %{REQUEST_FILENAME}.php [L]
Do you find it necessary to regenerate your DKIM keys every 1-6 months to avoid your mail going into the receiving servers' junk mail folder?
Some guides recommend this, some even say it's "Best Practice" to do so, but most other guides don't mention it at all. Evidently it is Best Practice to do so, but what is your real world experience?
Just modernized my old Debian 7 Postfix server to include DKIM + DMARC (+ SPF) and want to know if I should be doing ongoing maintenance to regenerate the keys.
What are most people doing? What are your real world experiences? Have you noticed old keys being the cause of your mail being sent to the junk folder?
I'm a low-volume sender, maybe 5-10 emails/day get sent through my server.
Is the Apache Directory directive supposed to be relative to the DocumentRoot or not? I ask in the context of a VirtualHost, but it shouldn't make any difference.
In other words, is it supposed to be:
<VirtualHost>
DocumentRoot /var/www
<Directory /var/www>
...
or
<VirtualHost>
DocumentRoot /var/www
<Directory />
...
Both work. The Apache Directory docs say:
Directory-path is either the full path to a directory, or a wild-card string...
... but then they show two examples contradicting the "full path" statement.
ED: There are also contradictory examples on the Apache Performance Tuning page in the FollowSymLinks and SymLinksIfOwnerMatch and AllowOverride sections.
For fun I looked at Debian's default vhost setup and found this:
<VirtualHost *:80>
DocumentRoot /var/www
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
</Directory>
...
I hope that title is clear.
How do I prevent HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (setup is Apache-SNI).
For example, using my abbreviated config below, requests for https://example.com (a non-ssl vhost) are being served by Apache at the ssl-enabled vhost https://example.org. I'd like to disable that behavior and possibly reply with the appropriate HTTP response code (unsure of what that is).
It may not even be possible, but I thought I'd ask.
# I actually have a SNI setup, but it's not demonstrated here.
# I don't think it's relevant in this situation.
NameVirtualHost *:80
NameVirtualHost *:443
<VirtualHost *:80>
ServerName example.org
</VirtualHost>
<VirtualHost *:443>
ServerName example.org
</VirtualHost>
<VirtualHost *:80>
ServerName example.com
</VirtualHost>
EDIT: Maybe a mod_rewrite rule in the first ssl-vhost?
This question is specifically about the charset Apache (2.2 in my case) uses when serving it's default internal pages. For example, mod_autoindex directory listings, not-found ErrorDocument pages, 500-Internal Error pages, etc.
The charset Apache is currently using for these built-in pages is iso-8859-1 (see screenshot).
Here are my relevant Apache settings:
# apache2.conf:
AddDefaultCharset utf-8
My OS is Debian 7 and I'm using it's default prefork binary. I was thinking the charsets on these pages might not be changeable. Or maybe there is a compile-time option that affects the default charset?
And in my (Debian-specific) /etc/apache2/envvars, I sourced my default locale:
$ cat /etc/apache2/envvars
. /etc/default/locale
$ cat /etc/default/locale
LANG="en_US.UTF-8
$ env | grep LANG
LANG=en_US.UTF-8
Modifying the Content-Type header with mod_headers has no affect on Apache's default internal pages.
How do I filter mail.info from /var/log/syslog (rsyslog.conf/Debian) while keeping messages greater than or equal to mail.warn?
I've tried just about every different variation of appending and prepending different combinations of mail, mail.info, mail.!info, mail.*, mail.warn, mail.!warn, but apparently the docs are smarter than me.
Currently I'm at this, but alas, she's a no-go:
*.*;auth,authpriv.none;mail.warn,mail.!info -/var/log/syslog
Edit: I'm having a really hard time understanding the semicolon delimeter and how it "restricts" previous entries.
I'm a little paranoid that my new mail server might not be configured right, and I'm wondering if I made a mistake somewhere. Or maybe it's just the way Yahoo does things with their mail service.
To Yahoo mail from my mail server:
Received: from 127.0.0.1 (EHLO hostname.example.com) (x.x.x.x)
by mta1199.mail.gq1.yahoo.com with SMTP; Tue, 09 Jul 2013 13:53:55 -0700
Received: from me.atwork (c-x-x-x-x.comcast.net [x.x.x.x])
by hostname.example.com (Postfix) with ESMTPSA id 66DB11B006B4
for <[email protected]>; Tue, 9 Jul 2013 16:53:54 -0400 (EDT)
The very first line of the Yahoo test is the one that has me confused. Why does Yahoo not know my server name like gmail does below? It seems to think it's 127.0.0.1. Is that because Yahoo isn't looking me up in DNS?
Received: from 127.0.0.1...
My gmail test got it right.
From gmail to my mail server:
Received: from hostname.example.com (hostname.example.com. [x.x.x.x])
by mx.google.com with ESMTP id n7si14797309oep.56.2013.07.09.13.55.25
for <[email protected]>;
Tue, 09 Jul 2013 13:55:25 -0700 (PDT)
Received: from me.atwork (c-x-x-x-x.comcast.net [x.x.x.x])
by hostname.example.com (Postfix) with ESMTPSA id 1F7F31B006B4
for <[email protected]>; Tue, 9 Jul 2013 16:55:24 -0400 (EDT)
I understand that I need to read from bottom to top to see the "path" my test emails have taken to their final resting place. For the most part I get what the headers mean. I'm just confused by the 127.0.0.1 part.
How can I stop Postfix from accepting mail to local-users @ my-FQDN from the outside world?
$ hostname -f
hostname.example.com
Postfix is accepting mail to any-local-user at my-FQDN. So we'll use [email protected] as the example local user I want to stop receiving mail for from the outside world.
I have a pretty basic Postfix/Dovecot/SASL/LDA setup, but let me share some of the details.
I've tried reversing users in /etc/aliases and Postfix's virtual_alias_maps.cf, but no luck. I've run newaliases and postmap after updating them.
#/etc/aliases:
#root: [email protected]
#/etc/postfix/virtual_alias_maps.cf:
root [email protected]
I think I have FOUR* (updated) choices left...
mydestination. I'm pretty sure I need to keep my FQDN here, so I don't think removing it is a good option. EDIT: Yes, although removing your FQDN from mydestination disables the outside world from sending mail to local users, this is not the proper way to disable it because that hoses other things.smtpd_recipient_restrictions to disable this? I can't find one in the docs.Here is the relevant part of my Postfix main.cf:
myhostname = hostname.example.com
mydomain = example.com
mydestination = $myhostname, localhost.$mydomain, localhost
smtpd_recipient_restrictions =
reject_unknown_recipient_domain,
reject_non_fqdn_recipient,
reject_unauth_destination,
permit_mynetworks,
permit
Here is the relevant part of my Postfix master.cf:
submission inet n - - - - smtpd
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_sasl_type=dovecot
-o smtpd_sasl_path=private/auth
-o smtpd_recipient_restrictions=
reject_unknown_recipient_domain,
reject_non_fqdn_recipient,
permit_sasl_authenticated,
reject
P.S. Here is the HowTo I took a lot of my setup from: VirtualUserFlatFilesPostfix
When does Postfix act as a client? When it sends mail to the outside world?
I'm trying to decide if I should set smtp_tls_session_cache_database.
There is a similar setting called smtpd_tls_session_cache_database (smtpd) which is beneficial when Postfix is acting like a server.
smtp_tls_session_cache_database affects the Postfix client TLS session cache and smtpd_tls_session_cache_database affects the Postfix server TLS session cache.
I also read the Postfix TLS readme, but couldn't find what I was looking for.
For what it's worth, my setup has Postfix receiving mail on port 25 (passed to Dovecot) and port 587 setup as SASL auth'd relay (also Dovecot).
Are SFTP up/download speeds something that's in the control of the hosting company? Can they throttle SSH traffic, regardless of the port?
I just signed up with a new hosting company. We'll call them Slow SFTP, Inc. I have another server with Fast SFTP, Inc. Both are in Dallas and both are in different data centers.
I noticed my SSH client (PuTTY) lagging when connecting to Slow SFTP, Inc., so I decided to run some tests from both companies. I ran several tests over several hours. I also changed sshd ports just to make sure traffic wasn't being throttled based on the port. It made no difference.
| Slow SFTP, Inc. | Fast SFTP, Inc.
-----------------------------------------
UP | 744 KB/s | 352 KB/s
DOWN | 150 KB/s | 1,723 KB/s
I find it strange that the download speed from Slow SFTP, Inc. is so much slower than the upload speed.
Note: These are 1:1 comparisons. Identical setups on both servers. No firewalls. Vanilla Debian 7/sshd installs.
I did a lot of searching, but there seems to be conflicting info on what the proper netmask for an aliased IP address should be. Some of the conflicting info seems to be FreeBSD-specific. I'm looking for the "most technically proper" answer, if there is one.
I've been assigned x.x.x.168/29.
Here is eth0:
address x.x.x.170
netmask 255.255.255.248
gateway x.x.x.169
So the proper eth0:0 netmask should be 255.255.255.something.
EDIT: Per the comment from Chris S, I am not using FreeBSD; I am using Debian. My understanding is that FreeBSD users should use .255 for aliases. But I could be wrong, so you should do your own research.
So I'm sitting here debating whether or not to just apt-get install Apache2 and MySQL or spend a day compiling them from source. My main motivation for compiling would be to improve performance. Another motivation would be to circumvent the "Debian way," but I guess I can live with it if I must.
My websites are moderately busy, but nothing too crazy. VPS hosting.
So in your experience, is there a noticeable performance gain from compiling from source or would I be spinning my wheels?
P.S. I already compiled PHP from source because I didn't like the "Debian way."
I'm updating my mail servers' rDNS and I think I have it all figured out except for one thing.
When I installed my OS (Debian Etch), the installer asked me to enter the "domain name".
hostname command?hostname command?My current /etc/hosts:
127.0.0.1 localhost
67.228.178.164 mrspock.example-old.com mrspock
My current /etc/hostname:
mrspock
$ hostname -f
mrspock.example-old.com
I need to update hostname -f to be mrspock.example-new.com.
Been surfing around for a solution for a couple days now.
How do I enable Apache hotlink protection without hardcoding my domain in the config file so I can port the code to my other domains without having to update the config file every time?
This is what I have so far:
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?example\.(com|net|org) [NC]
RewriteRule \.(gif|ico|jpe|jpeg|jpg|png)$ - [NC,F,L]
... And this is what Apache suggests:
SetEnvIf Referer example\.com localreferer
<FilesMatch \.(jpg|png|gif)$>
Order deny,allow
Deny from all
Allow from env=localreferer
</FilesMatch>
... both of which hardcode the domain in their rules.
The closest I came to finding any info that covers this is right here on ServerFault, but the conclusion was that it cannot be done. Based on my research, that appears to be true, but I didn't find any questions or commentary dedicated soley to this question.
If anyone's curious, here is the link to the Apache 2 docs that cover this topic.
Note that Apache environment variables (e.g. %{HTTP_REFERER}) cannot be used in the RewriteCond's CondPattern argument.
Is there a way to match mime-types similar to how the Apache 2 Files directive works?
For example, I might want to apply several customizations to all text/plain mime-types; intentionally not using the file extension or other criteria to match (which could easily be done with Files).
How do you setup a single Apache2 config to host multiple HTTPS sites each on their own IP address? There will also be multiple HTTP sites on just a single IP address.
I do not want to use Server Name Indication (SNI) as described here, and I'm only concerned with the important top-level Apache directives. That is, I just need to know the skeleton of how my config should look.
The basic setup looks like this:
Hosted on 1.1.1.1:80 (HTTP)
- example.com
- example.net
- example.org
Hosted on 2.2.2.2:443 (HTTPS)
- secure.com
Hosted on 3.3.3.3:443 (HTTPS)
- secure.net
Hosted on 4.4.4.4:443 (HTTPS)
- secure.org
And here are the important config directives I have so far, which is the closest I've come to a working iteration, but still no dice. I know I'm close, just need a little push in the right direction.
Listen 1.1.1.1:80
Listen 2.2.2.2:443
Listen 3.3.3.3:443
Listen 4.4.4.4:443
NameVirtualHost 1.1.1.1:80
NameVirtualHost 2.2.2.2:443
NameVirtualHost 3.3.3.3:443
NameVirtualHost 4.4.4.4:443
# HTTP VIRTUAL HOSTS:
<VirtualHost 1.1.1.1:80>
ServerName example.com
DocumentRoot /home/foo/example.com
</VirtualHost>
<VirtualHost 1.1.1.1:80>
ServerName example.net
DocumentRoot /home/foo/example.net
</VirtualHost>
<VirtualHost 1.1.1.1:80>
ServerName example.org
DocumentRoot /home/foo/example.org
</VirtualHost>
# HTTPS VIRTUAL HOSTS:
<VirtualHost 2.2.2.2:443>
ServerName secure.com
DocumentRoot /home/foo/secure.com
SSLEngine on
SSLCertificateFile /home/foo/ssl/secure.com.crt
SSLCertificateKeyFile /home/foo/ssl/secure.com.key
SSLCACertificateFile /home/foo/ssl/ca.txt
</VirtualHost>
<VirtualHost 3.3.3.3:443>
ServerName secure.net
DocumentRoot /home/foo/secure.net
SSLEngine on
SSLCertificateFile /home/foo/ssl/secure.net.crt
SSLCertificateKeyFile /home/foo/ssl/secure.net.key
SSLCACertificateFile /home/foo/ssl/ca.txt
</VirtualHost>
<VirtualHost 4.4.4.4:443>
ServerName secure.org
DocumentRoot /home/foo/secure.org
SSLEngine on
SSLCertificateFile /home/foo/ssl/secure.org.crt
SSLCertificateKeyFile /home/foo/ssl/secure.org.key
SSLCACertificateFile /home/foo/ssl/ca.txt
</VirtualHost>
For what it's worth, I prefer to have each of my SSL sites on their own IP instead of including one of them on the primary VHOST IP. Any links which show a standard setup would be more than welcome!
When I unset the Last-Modified header in Apache (ETags are also disabled), Firefox (4.01) will not cache any file regardless of whether I set a future Expires header or enable the Cache-Control header.
So is the Last-Modified (and/or an ETag) header required for browser caching?
From here:
If no validator (an ETag or Last-Modified header) is present on a response, and it doesn’t have any explicit freshness information, it will be considered uncacheable.
... well, if by "Freshness Information" they mean "Cache-Control" or "Expires" header, Firefox should be caching without the Last-Modified header.
EDIT FOR FURTHER FIREFOX INFO
Note that no attempt to generate a 304 on any PHP file served by Apache 2.2 in Firefox 4.01 is successful (reload, fresh visit, etc.) without a Last-Modified header, regardless of any combination being set of a valid caching Cache-Control header, the Expires header or both headers.
foo.php: content of this file simply echoes 'Hello World'.
HTTP/1.1 200 OK
Date: Mon, 06 Jun 2011 14:04:58 GMT
Server: Apache
Cache-Control: public, max-age=3600
Expires: Fri, 01 Jul 2011 21:23:55 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1594
Keep-Alive: timeout=10, max=500
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
EDIT FOR EVEN MORE STRANGE FIREFOX 4.01 FINDINGS
Even stranger, based on what I've seen with Firefox 4.01, no form of server-side cache control headers (Expires and/or Cache-Control) influence Firefox's caching behavior. Firefox only cares about Freshness information (Etag or Last-Modified).
In summary, if the file has been modified, Firefox reloads it, regardless of any Expires or Cache-Control headers. If the file doesn't contain any Freshness information, Firefox reloads it no matter what.
If anyone finds out differently in their observations, please update me.
ANOTHER EDIT
From this link:
13.2.1 Server-Specified Expiration
An expiration time cannot be used to force a user agent to refresh its display or reload a resource; its semantics apply only to caching mechanisms, and such mechanisms need only check a resource's expiration status when a new request for that resource is initiated. See section 13.13 for an explanation of the difference between caches and history mechanisms.
I have a pretty good understanding of the Content-Type header for most cases. I understand that for the following four examples, you would normally follow the MIME-type with charset=your-charset-here.
Content-Type "text/plain; charset=utf-8"
Content-Type "text/html; charset=utf-8"
Content-Type "text/javascript; charset=utf-8"
Content-Type "text/xml; charset=utf-8"
... and with images, no charset:
Content-Type "image/gif"
Content-Type "image/x-icon"
etc.
But what about these two? Should they or shouldn't they include the charset?
Content-Type "application/x-javascript"
Content-Type "application/xml"
I realize it's okay if they don't include the charset, but I would like to include it, if it's possible. They are just text-based files, after all.
I'm at the end of my rope and could really use some fresh insight/suggestions.
The problem:
While runing Apache 2.2.3 on Debian Etch, my Apache server frequently sends a request to ITSELF (to the LAST virtual host in the config file) on random incoming HTTP activity directed towards ANY of the 15 virtual hosts I have set up.
I even mirrored my live server to a local virtual box and I get the exact same behavior.
The (trunacated) logs:
[30/Sep/2009:16:44:04 -0400] (Remote-host:) 127.0.0.1 (400) (Request:) "GET /"
[30/Sep/2009:16:44:05 -0400] (Remote-host:) 127.0.0.1 (400) (Request:) "GET /"
[30/Sep/2009:16:47:07 -0400] (Remote-host:) 127.0.0.1 (400) (Request:) "GET /"
[30/Sep/2009:16:47:12 -0400] (Remote-host:) 127.0.0.1 (400) (Request:) "GET /"
The reason I know it's the last virtual host receiving the strange request is the 400-Bad request error above. Turns out my last vhost is SSL enabled and Apache is sending itself a non-SSL request for /.
My vhost config:
NameVirtualHost *:80
NameVirtualHost *:443
<VirtualHost *:80>
ServerName one.example.com
</VirtualHost>
<VirtualHost *:80>
ServerName two.example.com
</VirtualHost>
<VirtualHost *:80>
ServerName three.example.com
</VirtualHost>
<VirtualHost *:443>
ServerName secure.example.com
</VirtualHost>
So when you send an HTTP request to one.example.com, (sometimes) the log file for secure.example.com will be as shown above. WEIRD! I ran mod_dumpio and mod_log_forensic, but didn't gain much insight from them.
What in the world could possibly be causing this?
What I know:
Edit (The Fix):
In case anyone else stumbles upon this, here is what I did to remedy the situation.
Change the order of my Apache Listen directives:
Listen 192.168.0.199:443
Listen 192.168.0.199:80
Then add a rewrite rule to my FIRST virtual host:
RewriteCond %{REMOTE_ADDR} ^(192\.168\.0\.199|127\.0\.0\.1)$
RewriteCond %{HTTP_USER_AGENT} internal\ dummy\ connection [NC]
RewriteRule .* /apache-internal-dummy-connection/ [R=302,L]
The rewrite rule simply says, "if the remote users' IP address is the same as my web server AND the remote users' agent (browser) contains the words 'internal dummy connection', redirect (302) any request to http://www.example.com/apache-internal-dummy-connection/".
I chose to redirect to a non-existant URI to keep the load down on my server.
Used tail -f on my first vhost log file and it's working fine on both servers.
Hope this helps someone.