BeetleJuice's questions

I am running Ubuntu 18 (well, really Windows Subsystem for Linux with Ubuntu 18 distro). I have installed redis 4.0.9. If I start it with no config specified, it works out ok:

redis-server

However, if I start it using the default config file that installed, it throws an error:

Why would this be? I modified the default earlier but then I uninstalled with --purge and reinstalled redis-server to get back the original default config. Still the error persists.

You can see the loaded config that's causing me trouble here: https://defuse.ca/b/g4wHiT0SlX0AUcpuSpgx3v

PS

I posted this on StackOverflow after realizing that there may be the better forum since there are only a couple of hundred qs about redis here, but over 15,000 there. Sorry about the duplication.

I started using Nginx today for the first time, and I'm also new to command line so please be gentle.

I have a CentOS 7 server that hosts an index.html file that I would like to access from the internet. However I get a 403 Forbidden and Nginx seems to not have the permission to read and serve the file. I'm trying to figure out why.

The webpage is in the home folder at /home/Owner/web/apps/webapp/index.html. Here is the error logged by Nginx when I try to access that file from the web:

[error] 9887#0: *6 "/home/Owner/web/apps/webapp/index.html" is forbidden (13: Permission denied), client: CLIENT_IP, server: my-domain.io, request: "GET / HTTP/1.1", host: "my-domain.io"

SELinux is enabled on the server. Here is the SELinux security context for the index.html file:

[[email protected] ~]# ls -lZ /home/Owner/web/apps/webapp/index.html

-rw-r--r--. Owner Owner unconfined_u:object_r:httpd_sys_content_t:s0 /home/Owner/web/apps/webapp/index.html

So the file is world-readable, what's the problem? Here is the SELinux security context for the nginx process:

[[email protected] ~]# ps -auxZ | grep nginx

system_u:system_r:httpd_t:s0 root 9886 0.0 0.0 121508 2132 ? Ss 19:50 0:00 nginx: master process /usr/sbin/ngin

system_u:system_r:httpd_t:s0 nginx 9887 0.0 0.0 121512 3604 ? S 19:50 0:00 nginx: worker process

system_u:system_r:httpd_t:s0 nginx 9888 0.0 0.0 121512 3604 ? S 19:50 0:00 nginx: worker process

unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 9914 0.0 0.0 112712 960 pts/0 S+ 20:03 0:00 grep --color=auto nginx

I have set the following SELinux flags:

setsebool -P httpd_can_network_connect on

setsebool -P httpd_enable_homedirs on

Interestingly, setting SELinux to Permissive with setenforce 0 does not make the problem go away. I still get a 403 forbidden. I have tried rebooting the server to no avail.

Here is Nginx http configuration:

server {
    listen       80;
    listen       [::]:80;
    server_name  my-domain.io;
    root         /home/Owner/web/apps/webapp;
    
    location /api/ {
        proxy_pass "http://localhost:3333";
    }
}

Note the proxypass directives for /api/; that works just fine! I can hit those paths and query the Node service running on port 3333 from the browser. The files that node executes are in a sibling directory to index.html parent directory.

What am I overlooking?

The websocket library I rely on (PHP-Websockets) does not yet support secure sockets (wss). My website is served over https though, so I cannot use insecure ws connections.

I'm trying to use Apache's mod_proxy to forward the secure request that comes from the browser on to the client.

Javascript

var ws = new Websocket('wss://example.com/_ws_/');

Apache VirtualHosts

ProxyPass        "/_ws_/" "ws://127.0.0.1:8080/"
ProxyPassReverse "/_ws_/" "ws://127.0.0.1:8080/"
# I've also tried "/_ws_/" "ws://example.com:8080/"  Same error below

Upon trying to connect, the browser receives a 500 Server Error. The logs show:

No protocol handler was valid for the URL /_ws_/. If you are using a DSO version of mod_proxy, make sure the proxy submodules are included in the configuration using LoadModule.

I've confirmed that if I remove the proxy rules, stop redirecting users to https and try to connect to insecure sockets from the browser: new Websocket('ws://example.com/'), things work just fine.

My loaded Apache modules include mod_ssl.c, mod_proxy.c and mod_proxy_http.c

Apache 2.4

I wish to set a response header in .htaccess but only when the site is loaded over HTTPS:

Header set MyHeader "%D %t" "%{HTTPS:on}"
# Error: Unknown parameter: %{HTTPS:on}

Header set MyHeader "%D %t" "expr=%{HTTPS:on}"
# Error: syntax error, unexpected $end: Function 'HTTPS' does not exist

Header set MyHeader "%D %t" "expr=%{HTTPS}==on"    
# Error: syntax error, unexpected $end, expecting '('

HTTPS is listed as a variable here

PS: I'm having a really hard time understanding how Apache expressions work so if anyone has come across a simple introduction with good examples, please share.

I use Apache's mod_info to display detailed information about my server setup.

httpd-vhosts.conf

# Set path below to be handled by mod_info. It will show server info. 
# For this to work, this module must be loaded (uncommented in httpd.conf)
<Location /special/path>
   SetHandler server-info
   Order allow,deny
   Allow from 127.0.0.1
</Location>

Allow from is set to the local machine because this is on my dev machine.

This module allows me to see a tremendous amount of information by navigating to /special/path. I'd like to use it on my public server but need to secure it somehow so others cannot load that path.

The docs discuss whitelisting by IP address but I have an organizational IP, shared by many.

What's the most practical way to protect this path? Apache 2.4.16