Can someone answer me the question if i can connect my apache with an active directory 2000 server through mod_authnz

CheapWebHosting.co.nz

Currently using zoneedit for registrars DNS to vhosts on my server though I am running webmin-bind-virtualmin
Guys i can run the script now but -testcgi but when i run it via web it tells me to download the file i have tried

i have a hosting server, if domain.com/ has two sub directories userA and userB i want that each directory access only one database for each of them , is it doable ?

a domain host doesn't have directories or subdirectories. A filesystem does.

call it whatever

then your question is too ill-specified to have an answer. I could say "yes" or "no", and both are equally true

the domain has a user directory on the hosting server hosting and subdirectories that's what i'm talkin about

if it's a hosting server, then your host's documentation will (or should) tell you what's enabled there

AuthType

AuthType is http://httpd.apache.org/docs/2.2/mod/core.html#authtype

running sushi has almost infinite supply of food! You can't steal it!

mmm

mmm, hog jowels

try that

if I get a 403, it means the directory exists but cannot access it, right?

403

403 is Forbidden or don't forget to look in the error log

yes

Roobarb-Work: sure will

mmm, roobarb is in season

ok, I have "Alias /foo /bar" now, when I enter http://myserver/foo/file_in_bar that should give me the file file_in_bar in the directory /bar or not?

rhubarb

rhubarb is _very good_

what's the problem you are seeing?

yango, I get a 404 although I know the file exists.

what does the error log say?

'/www/ruby/laurastarcouponstest.php' not found or unable to stat
ah ok
ah

the error log say "look at me, I'm so wonderful"

see why it's useful to look in the error log?

ok
yeah, sorry about that.

hi.. having problems with permissions on /server-info. http://apache.pastebin.ca/561218 . 1. works 2. doesn't although I connect from the IP given in "Allow from". When I use configuration 2. I get the following error in the log: "[client 1.2.3.4] client denied by server configuration: /home/sites/www.foo.com/webapp/server-info" . /webserver is the DomumentRoot of my first VirtualHost
hi.. having problems with permissions on /server-info. a href="http://apache.pastebin.ca/561218"http://apache.pastebin.ca/561218/a . 1. works 2. doesn't although I connect from the IP given in "Allow from". When I use configuration 2. I get the following error in the log: "[client 1.2.3.4] client denied by server configuration: /home/sites/www.foo.com/webapp/server-info" . /webserver is the DomumentRoot of my first VirtualHost
I don't have any DocumentRoot in the main part of the httpd.conf

order allow,deny

order allow,deny is The Allow directives are evaluated before the Deny directives. Access is denied by default. Any client which does not match an Allow directive or does match a Deny directive will be denied access to the server

order deny,allow

order deny,allow is The Deny directives are evaluated before the Allow directives. Access is allowed by default. Any client which does not match a Deny directive or does match an Allow directive will be allowed access to the server

do you allow the access to your [second] documentroot?

yup - root access to the server
from what I read in the online docs and what fajita just told me - my settings should be correct

they are. But that doesn't mean that something different isn't wrong.
what do youy get when you try to access the / URL/

right
like in www.foo.com/ ?

instead of www.foo.com/server-info
Just so that we can see the comparison.

works - although there is a Redirect of / to http://www.foo.com/index.html
sorry - "/webserver" in not my DocumentRoot - but "/webapp" is
typo...

*shrug*
I don't know your vhost configs, or your baseconfig.. I only know this location stuff, and I know that it should work and I know that your server says that it doesn't because you did something wrong.
just for clarifying things, I would suggest you swap the deny and the allow line in the second config.

k - my first vhost with the DocumentRoot /webapp hast a "Deny from All" to his /webapp - the actual content is in /webapp/static - which has a "Allow from All"

get's evaluated later than Directory /webapp

block

you editing that doc?

how does one right to syslog from apache. not by mapping the entire access_log to syslog though
how does one write to syslog from apache. not by mapping the entire access_log to syslog though

so what do you want in syslog?

jMCG:i need to write a certain error to syslog instead of the usual error_logs of apache

access log != error log

-- back

\ø/

Roobarb-Work: wb!

\ø/
|
/ \

yango, you FREAK!

he's back!
\o/
shush
or am I freak for having ø as a head?

yep.

hehe

it's my hay
hat

hat is all the buzz about AJAX

fajita forget hat

I forgot hat

understandable... in short have apache write directly to syslog . DO you know of a way ?

you could filter stuff you log to syslog with SetEnvIf

ErrorLog syslog:local1
then configure syslog.conf accordingly

won't that make all errorlogs go to syslog ?

http://www.oreillynet.com/pub/a/sysadmin/2006/10/12/httpd-syslog.html
written by DrB no-less

yea
h

I have an apache configured as reverse proxy for different "backend"-Apaches. But I want the /server-status -Page from the reverse Proxy. I made a Line "ProxyPass /server-status !" in every VirtualHost-Definition, and I try to fetch the server-status by telnet using as Host-Line the IP of the reverse proxy. I get a "403 Forbidden" as result, even when I have allowed the request of the server-status-page from 127.0.0.1, the ip of the reverse pr

what does your error_log say ?

Roobarb-Work: nothing, unfortunately
just a minute...

what about the error_log on the back-end server?

yesterday I got a "client denied"
Roobarb-Work: just checking

elaborate

You make no sense, try to rephrase your question and elaborate on what you want, what you tried, and what didn't work (paste the error message you see in the error log, usually named error_log or error.log). Also tell us what platform you are on and what version of apache you are using.

damn wrong factoid
verbatim

Verbatim means "word for word" "copy and paste". It means we want the exact error message from the error log. That also means use a pastebin for 3 lines. Ask me about 'apc' for which pastebin to use.

thats the one I meant ^

nothing on the backend-apaches

hmm, I have to go three steps bacjk
if I got _yesterday_ correct error messages in the error-log that means I was at the correct end at that time

you got client denied, where was that?

today I have no error message but a forbidden - that means it's coming from somewhere else
so first I have to get that error again appearing in the right error log

if you get a forbidden you will get a matching log entry

shutdown the back-end servers and re-try
assuming you can do that

I also assume you have mod_status enabled

Location /server-status
SetHandler server-status

is set correctly? not deny for all?

etc

forget Location /server-status

I forgot location /server-status

at least with httpd -l I can see it
Location /server-status
SetHandler server-status
Order deny,allow

Order deny,allow is The Deny directives are evaluated before the Allow directives. Access is allowed by default. Any client which does not match a Deny directive or does match an Allow directive will be allowed access to the server

[..] /Location
gee, I found it
Hmm

what (was|is) it?

Order is important. You need to put the exclusion marks _before_ the general proxypass directive.
that was my problem
I made _first_ the ProxyPass / URL and in the next line the negatoin
negation
he redirected me to the backend-server - and the first virtualhost configured got the request
(since it was an unknown Host-Line)

Can someone answer me the question if i can connect my apache with an active directory 2000 server through mod_authnz_ldap etc when i have kerberos5? AD2000 uses Kerberos4 and i dont know if this is the problem because i dont get the authentication against the AD2000 to work with my apache. My Apche rund under an SLES10 and SuSe9.3 has kerberos5 to. So ist it right that i can only connect against an AD2003 because of the different kerberos versions????

AD / mod_ldap is a known problem, though it can be done

does kerberos plays a role when i want to connect my apache with the ad? or is this no problem with kerberos5

it works fine, I am just trying to find where, I read an article recently.

pctony I habe apache2.2 with all modules (mod_authnz_ldap etc) and a working config. I read about 10 howtos an my config is the same

look at marc.info, and search through that last 4 weeks worth of email web hosting for users@httpd.apache.org
paste the config then please
apc

Try using http://apache.pastebin.ca - It's a good pastebin, and is even set up to highlight Apache 'stuff'.

ok one moment
here is my config http://sial.org/pbot/25513

that site times out from here, can you use apc please?
apc

Try using http://apache.pastebin.ca - It's a good pastebin, and is even set up to highlight Apache 'stuff'.

do i only have to paste the code there?

rather than?
just your config
please

http://apache.pastebin.ca/561361

which guide did you follow?

pctony's ultracool LDaP guide to Apache.

(sp?)

excuse

There isn't any problem

...

be roy

If I make this change on the admin side of the database, does it change it on the user side too?

spelling for insolence is okay. Slapping is not.

hehe
hey

pctony is the config ok?
after 5 other guides i follow this one http://www.linux-club.de/faq/Apache_mit_LDAP

*YES*
it works

Damn right it does

I can now ask the backend-server for server-status _and_ the reverse proxy

which guide is this?
hehe
yeah that looks ok

it doesn't exist yet.

I had to use some tricks, but now I can use munin to monitor it

what is in your errorlog?
lol
I like munin

except you can't see the status if the back-end servers if the proxy is down

I like the defintions for munin. http://www.urbandictionary.com/define.php?term=munin

sorry telephone ....
7 2007] [warn] [client 192.168.0.140] [14155] auth_ldap authenticate: user ffr authentication failed; URI /svn [LDAP:
failed][Invalid credentials]
7 2007] [error] [client 192.168.0.140] user ffr: authentication failure for "/svn": Password

two probs
well one initially
the creds you are binding to AD with are wrong somehow
you adsiedit to get the corrent CN for the user object

hm. you mean the binddn?

yeah

anyone that can help with a apache2 problem?

i test about 20 different binddn lines but i always get this error so i think it is the kerberos5 because ad2000 useses kerberos4 or is that not the problem?

unlikely, /me thinks.

not if you don't specify your problem.

Nat to my apache2 server but I cant see it from the external

did you search through marc.info as i suggested?

ok so i will test with the correct path from adsiedit agian

Is there any security options ?

oh no i will search now. Is there a howto or what?

running debian 4.0 apache2

no, but someone in the users@httpd.apache.org group mentioned this the other day

jMCg, any idea?

pctony i think i am to stupid after today ... there is no group calld users@httpd.apache.org

bonjour, m1r.

i have little problem with CMS installation, when i accses it over localhost i see site , tables and pictures , but when i access it over network pc, all i can see is text

nope.. you're still being VERY unspecific.
elaborate?

http://marc.info/?t=118115600300002&r=1&w=2

apache2 , php 5, mysql , joomla

okay, I have a RT running on my apache2 on Debian 4.0. I can see my webpage with the internal IP but if I try to look at with my external IP. I this this "the page cannot displayed..."

it shows on localhost/sitename, but when i go over network 192.168.1.2 then all seems broken

So any ideas for whic option I should edit on my apache2, so it is possible to see from the external IP ?

is Apache bound to your LAN dedicated ip hosting ?

thanks pctony i will have a look at this and then have a new try with adsiedit

I thing so

wrong answer

Roobarb-Work, Iam not sure where can I check that?

look for "Listen" lines in your configs

I'm very happy for you, now answer my question

no, its not bound

I assume, since you haven't said what it IS bound to, that it says: Listen 127.0.0.1:80
?

yes

change it to say: Listen *:80
Listen *:80
can I have some moonshine with those?

hey all, im having problems compiling apache, wonder if anyone can help?

any particular reason you're not using a pre-build version for your distro ?

Not really, just thought it'd be better to compile one specific to my machine

Roobarb-Work: if you like
good man

whats the problem?

could you be a little more specific with the problem

ok, well. it configures fine. i've got the latest runtime thingy. but when i run make it says 'previous definiton of ' (something) ' was already defined here' in exports.c
theres lots of them
like 50

pastebin it all

i tried reconfiguring, and same problem

apc

Try using http://apache.pastebin.ca - It's a good pastebin, and is even set up to highlight Apache 'stuff'.

ok, thanks
so i just paste the error to the pastebin and wait for a responce?

no, tell us the url

ok
http://apache.pastebin.ca/561453

Roobarb-Work: that wiki page has just been updated by jslive, have a look

Roobarb-Work, how can I change to *:80 ?

with a text editor
that flows a bit better

Roobarb-Work, whic file?

the file that contains the "Listen 127.0.0.1:80"

*its changed to allow all

good afternoon

0" to "Listen *:80"

Roobarb-Work: yeah, josh is very good at docs writing

I've just done ./configure && make, on a vanilla 2.2.4 tree and it's worked - what ./configure line did you use?

just ./configure on its own

http://apache.pastebin.ca/561519
thats my ./configure

When I query a PHP page on my local Apache 1.3.37, then it sometimes takes several seconds to load. What could be the reason? Some timeout?
PHP 4.4.7

depends what the page is doing I guess

Roobarb-Work, very simple things.
Even test pages with only an "echo" in them sometimes take long to load.
But once loaded, reloading seems to be rather quick.

how heavily used is the server?

Roobarb-Work, It's my laptop and only I am using it (locally).
Load is very low.
Must be some configuration issue, or it's natural in PHP.

it might be your disk spinning down?

No.
It never does.

are you using much/any swap ?

I want to upgrade to PHP 5 anyhow.
No swap.
The system is almost idling.

then I'm not sure

I'll upgrade to PHP5 ...

anyone available

ask

If you have an apache related question, please go ahead and ask it. We will not beat it out of you. We won't bite you either, at least until we get to know you better

ok here goes
i am new at this .. what other config do have have to do to the httpd file the get this server up and running....
like uncomment

www.linux-corner.info/httpd.conf is a generic example

To just get it running, you can use the default config file as shipped.

its work from http://localhost

afk

Is there something that's not working as desired?

i am using (i know using windwos xp)
Roobard

Roobard is "pastebin normally such a slow site

do i have to uncomment anything

That would take me back to the question that I just asked.
Is there anything that is not working as desired?
By default, no, you can run with the out-of-the-box configuration file.
Unless there's something that's not working.
What exactly is happening, and in what way does it differ from what you want to be happening?

it works from http://localhost but what i try to access from the from www using my stite address it does work...
ihve open ports 80 and 443

Presuming you meant "doesn't work" rather than "does work", can you be more specific. Precisely what doesn't work.
What exactly is happening, and in what way does it differ from what you want to be happening?

doesnt

What is the URL of this site?

ok my site adress is you2stream

hmm... http://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#order has got the Order definition exactly the other way around than http://httpd.apache.org/docs/2.0/mod/mod_access.html#order - is that correct? I'm using Apache/2.0.46 but my access configuration seems to work like Apache 2.2

That's not a valid address. Can you give the full URL?

is this a bug in the docs?

ok my site adress is www.you2stream.com

Yes, it is. It's also a bug in the design of Order that makes it so darned hard to describe non-confusingly.

that's a pity - couldn't anybody change the docs?

The docs have been fixed for 2.2, and apparently the fix never got backported.
Yes, I could indeed change the docs.
I'll make a note to do that this evening when I have a chance.

great - thanks!

order allow,deny

order deny,allow

DR i running to 2.2.4 version

It appears, from outside, that port 80 is firewalled.

no the firwall off

Perhaps you have the firewall off on the Windows machine, but then there's your internet router, and that of your ISP.

hmm

Somewhere between me and you, there is a firewall, blocking port 80 traffic.

ok
i did the portforward 80 in the router

Then perhaps your ISP blocks port 80.
firewall

sorry...

the customer is striped just windows XP and apache nothing esle
i am using comecast
customer=computer
LOL

what percentage ratio of the servers overall memory should be set to the mysql query cache?
10%? 20%?

`Mace: This is #apache.

oops.

oops is an understatement... :P

http://issues.apache.org/bugzilla/show_bug.cgi?id=41767

Hey Roobarb, I think i've found the solution. An old version. Thanks for the help anyways. Much apreciated.

Drbacchus could you try my ip address
is there a port scanner out there to help me ascertion if port 80 is block

but - so the description (below "Ordering is one of:") on http://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#order is correct, right?

how do i disable the logging in apache 2.x? i was told something about customdirectives in apache2.conf but i'm not sure what exactly i need to do

CustomLog

CustomLog is http://httpd.apache.org/docs-2.0/mod/mod_log_config.html#customlog or http://httpd.apache.org/docs/mod/mod_log_config.html#customlog

evening
apache 2.2.4 #LoadModule php5_module "c:/php5/php5apache2.dll" apache wont restart it fails

What, exactly, does the error log say?

what version of php?
fyi, php 5.2 doesn't work with apache 2.2 on windows. known issue with them... need to get 5.2 or better

ubuntu-rocks: just comment out all of your logging lines that are pointing to files (i think)

:o)

httpd.exe: Syntax error on line 486 of C:/Program Files (x86)/Apache Software Foundation/Apache2.2/conf/httpd.conf: Cannot load C:/php5/php5apache2.dll into server: The specified module could not be found.
thart s from the log file
but the dll is their
it is apache 2.2

could very well be that it relies on some other dll that isn't present

can I have a virtual host foo.domain.com, and then another section *.domain.com?
so that the foo subdomain has his own stuff?

should be possible

fine

order matters, though

I guess most specifi first

that's be swell

well gee... let's not answer my question... what version of php?

ahh it worked :/ used php5apache2_2.dll instead of 2.dll

lart!

lart is L'User Attitude Readjustment Tool or http://get.a.clue.de/gfx/lart.jpg

thx sorry for bothering need to read more about 2.2.4

arreyder - i only have lines like, logformat .... Are these the lines i'm after to disable logging?

ubuntu-rocks: CustomLog and ErrorLog
lines
ubuntu-rocks: is the a performace of privacy thing, 'cause there are ways to maintain good perf. and still get logs. Just log to the network via syslog/mod_log_spread/something

Hi there. I have an HTTP question: http://pastie.caboo.se/69772

can anyone see why i'm getting '403 forbidden' on / when I setup mod_proxy with this config? http://rafb.net/p/dxGYlo86.html

How do I know where that is redirecting to?

I'm impressed; ./configure --enable-mods-shared=all && make, actually works flawlessly. If you tried that with other programs whete you can --enable-everything I'd expect _something_ to fail...

Visiting the site in a browser does not yield the URL in Location

s/of/or

the 302 is a result of http://www.shakenbaby.com being redirected to http://shakenbaby.org/

Roobarb-Work: it doesnt actually build them all though
or at least it didnt used to

Roobarb-Work: How do I know it's going ot shakenbaby.org?
(I'm using ruby's net/http library)
s/ot/to

$ find modules/ -name "*.o" | wc -l
132
if thats not all the modules, then I'm impressed as to how many there are

Roobarb-Work: And the body is blank, as you can see

eh? I get a website

Look at that paste
It shows their hosting provider as the redirect location

type www.shakenbaby.com into a browser

I know.

Visiting the site in a browser does not yield the URL in Location

What is telling the browser to go to shakenbaby.org?
I don't see anything in that response

arreyder - actually i'm just running out of disk space, i only have 6 gig drive in the box. Have to replace the box one that has a bigger drive!

part is what tells the browser where to go
that's not telling it to go to shakenbaby.org, it's telling it to go somewhere else

I know.. that's why I'm baffled as to why it goes to shakenbaby.org

have you looked at the source of the page it goes to?

Doesn't help my link checker/updater :/

that might have something in it to redirect to shakenbaby.org

hey, I have 3 virtual servers set up, everything is gong to the first one the :-| http://rafb.net/p/wK3VwV65.html. any ideas?

can anyone see why i'm getting '403 forbidden' on / when I setup mod_proxy with this config? http://rafb.net/p/dxGYlo86.html

theres a chance that the hosting provider is doing some tricks with the referer

permissions
or your Options

your Options is ?a) reorganize such that you get around one of those limitationsb) use access control lists

Roobarb-Work: They must be. The body is empty and the location goes to them

Jabberwock, file permissions?

Could either be lack of certain Options or file permissions
Make sure the folder and all its parents are chmod'd to 755

well, i'm not actually hosting any directories
just making it a reverse proxy

What's your setup?

your setup is not optimal at all

oh
didn't see the paste. *looks*
Where's the ServerName?

the ServerName is http://httpd.apache.org/docs-2.0/mod/core.html#servername or http://httpd.apache.org/docs/mod/core.html#servername

There's a standalone server for something else on port 8080, and i want apache to redirect /jira on port 80 to it

what does the * in this do?

I just packet-sniffed a lynx connection to www.shakenbabycom

it's a wildcard

where can i find reference to the apache.log in a config file?

Someone already did a mod_dav_svn into the / of a VirtualHost ?

*:80 is better
Roobarb-Work: yeah?

(SVNParentPath to be exactly)

and I see a 301 with Location: http://shakenbaby,org/

and if you wanna sent me to #svn, i kill you (question already dropped there)

section

should that be the address of the vserver?

use mod_proxy_balancer ;P

Jabberwock, that's because I just want to use it as a reverse proxy, nothing else

yet using wget (and nc) gives different results

Roobarb-Work: Maybe it requires a user-agent to be passed

wget passes one...
www.linux-corner.info/lynx.pcap
load that into ethereal and look at packet #6

hrm
thanks

How can I configure apache s.t. it only serves pages to the machine it's running on?

s.t. ?
== so that?

such that

ok, close

only enable 127.0.0.1 ?

http://127.0.0.1

http://127.0.0.1 is Agiving me the APACHE page but http://localhost is not... how come

interesting

order allow,deny

allow from 127.0.0.1

http://rafb.net/p/wK3VwV65.html - can anyone tell me why this Vserver is hogging all the limelight, I have similar Vservers for a couple of subdomains but everything is going to www :-|

deny from *

how can I redirect a certain range of ips to a new url ?

Roobarb-Work: wget -S --user-agent Lynx http://www.shakenbaby.com/

ie if they access example.com/webapp (if internal redirect to) localwebserver/localwebapp

Stupid sunone asp server

8 2007] [warn] NameVirtualHost *:0 has no VirtualHosts" when i reload apache, and my vhosts doen't work quite right. what is

ServerName blah.com, etc

not all on one line, of course

they're really gone out of their way to break certain clients :/

Roobarb-Work: Yeah..
cdc.gov does it, too
I'll just set the user agent
I didn't think web-servers actually cared. It seems moot seeing as any spider can spoof its user agent

with apache, you have to configure it to care

hey, this may sound like a stupid question, but how do I get php to process the .php files? Apache works, but when I put 'localhost' it just shows my source instead of the page I want it to process.

I'm gobsmacked if someone actually believes it to be necessary

im using the latest version of php with apache 2.0.59

mpd_php
mod_php

mod_php is see php

php

php is enabled by loading mod_php and using the AddHandler directive to activate it. See also CGI The proper application type is: application/x-httpd-php or see http://www.devside.net/articles/php

ahhh. ok

Roobarb-Work: probably bored and wanted to look busy

I would like foo.domain.com to be a vhost, and *.domain.com to be another vhost where all subdomains different from foo are directed, I set a single NameVirtualHost IP:8080 and then vhosts foo.domain.com:8080 and *.domain.com:8080 to no avail, everything is served by the first one

AddHandler application/x-httpd-php .php

fxn make the * one the first vhost in the script

oh right, I have them the other way around

fxn, I mean, last

8 2007] [warn] NameVirtualHost *:0 has no VirtualHosts" when i reload apache, and my vhosts doen't work quite right. what is

erm... ok. is that a setting in a configuration file? sorry if i sound like an idiot. im fairly new to this

I'd do it another way - NameVirtualHost *:80, then use ServerName foo.example.com in one Vhost, and ServerName *.example.com in the other
yes, in your httpd.conf somewhere

ahh, ok thanks
shall i just stick it at the bottom yeah?

I'd stick it before any VHost definitions

Roobarb-Work: the order matters there?

if anything, put the * one at the end
Apache processes them in top-down order

Roobarb-Work: and what goes in the VirtualHost directive?

VirtualHost *:80
or 8080, whetever you want

hi there, I've running apcahe2.0 on ubuntu and having a problem with mod_rewrite and proxy

the XXX:YY has to match

in both cases?

yes

I've got a java process running on hostname.lan:8888, so I've setup RewriteRule (.*) http://hostname.lan:8888/$1 [P,L]
the result it I get a page loaded, but no images or css

spike, use mod_proxy instead of mod_rewrite

mod_proxy_html

mod_proxy_html is at http://apache.webthing.com/mod_proxy_html/. Ask me about "reverse proxy". See http://bahumbug.wordpress.com/2006/11/07/mod_proxy_html-30/

try using mod_proxy: ProxyPass / http://www.example.com:8888/

and in like 5 seconds it changes to localhost:8888 by itselfs and displays a cannot connect to server (has I have no such process running locally)
uhm, I thought that mod_rewrite was exactly doing that

you'll need mod_proxy_html to fix your links in your proxied pages...

or ProxyPassReverse, maybe

in fact you have to enable mod_proxy for mod_rewrite [P] to work

Roobarb-Work: I must be doing something wrong dammit, everything is served by the first one, the foo

me too, and in that case it's possible

can I redirect a page if and only if an ip matches ?

the first one is the default if nothing else matches

tomcat reverse proxy

tomcat reverse proxy is Ohttp://moin.eta-beta-pi.net/httpd-docs/HTTPDocsWiki/recipies/TomcatReverseProxy

there's a little tut...

checking that, ta

with mention of mod_proxy_html to fix links

yes, there's an example in the mod_rewrite cookbook

The requested URL /httpd-docs/HTTPDocsWiki/recipies/TomcatReverseProxy was not found on this server.

where is the cookbook?

oh poo... i wonder if they've been fsckin' with the locations again...

If you see this it means you have come to a site you are not supposed to.
So please check and try again

rewrite.drbacchus.com/ ?

right. i've added the line to httpd.conf, but its still giving me the same probs

google mod_rewrite cookbook

http://rewrite.drbacchus.com/

I have NameVirtualHost *:8080 + VirtualHost *:8080/ServerName foo.domain + VirtualHost *:8080/ServerName *.domain, in that order top-down

http://wiki.apache.org/httpd/Recipes/TomcatReverseProxy

I need to 'redirect', not rewrite

or am I wrontg?

try that... they have been futzing with the locations of the wiki pages...

mod_rewrite can do redirects

no fajita tomcat reverse proxy is http://wiki.apache.org/httpd/Recipes/TomcatReverseProxy

okay, megaspaz.

ah old link...

what's the keyword for redirecting when rewriting?

[R]

[R] is a redirect

I'm having a Directory / -"Deny from all" in the main part of httpd.conf which is working. I got a vhost with a DocumentRoot in /home/foo/ . This is accessible by default - is this normal? I would have though that /home/foo inherits the permissions from Directory /-"Deny from all"

[L]

[L] is for last

and you'll want to use rewritecond as well if you want to rewrite based off of ip

[PT]

[PT] is pass through to next handler

thanks, fajita

i'm not following you...

I don't have any access permissions set on /home/foo

directory /

is a filesystem directory, not a URL path. If you put options in this block, don't be surprised when whatever you're trying to do doesn't work.

huhu

where can I get a list of all the parameters, such as %{HTTP_COOKIE} etc

and yes directory blocks do inherit unless you specifically tell them otherwise...

you should only have 2 Virtual Hosts

rewritecond

rewritecond is http://httpd.apache.org/docs/2.0/mod/mod_rewrite.html#rewritecond

which you do, re-reading that :o)

I didn't put any Options

Roobarb-Work: ok :-)

what about access controls?

let me try something

bah... still no luck with the php. =(

okay - so those are options in this context...

Roobarb-Work: fixed
Roobarb-Work: same config with reversed order
Roobarb-Work: most-specific last

does not what it's supposed to do?

Hi, where can I get some help/tips regarding setting up Webdav ??

doesn't do anything because the docroot overrides those

hmm ok

I don't see a variable for the requesting person's IP

I need to create separate webdav areas (directory trees) , each with distinct access rules, whats the best way to set it up ?

and I set an "Allow from all" on Directory /path/to/docroot/subdir

as in "hmm, I wonder why the default as to be _first_..."
*has

I'm sure there is one, but I don't see it,

options=access control list

is there any reason why apache on debian wont allow multiple vhosts, is there some setting that Im missing? http://rafb.net/p/wK3VwV65.html

hello all quick question. I need to change my ssl configuration from wildcard certificate to multiple certificates meaning I will need to be able to have apache recognize multiple certificates for different host
What would be the best way to do this

ttf options != access control

Roobarb-Work: perhaps as Apache processes the config file stuff overwrites previous stuff?

you've got an allow from all in your docroot. everything in your docroot will be allow from all unless you scope a particular subdir in there with a different access control...
and order matters as well...

if you don't have many IPs you should do something with the port numbers

That is not an option... is that the only way

ssl vhosts

When using SSL, each virtual host must have either its own IP address or its own port. Or both. or for details see http://httpd.apache.org/docs-2.0/ssl/ssl_faq.html#vhosts2 or http://www.onlamp.com/pub/a/apache/2005/02/17/apacheckbk.html or see SNI or consider wildcard certificates or http://wiki.cacert.org/wiki/VhostTaskForce or see ip based vhosts

yes

read that ^

or buy more ips

the onlamp article explains it all

sorry I meant: "...but I didn't set access control deliberately..."

Thanks

sorry...

read it carefully and you'll know what to do
^

so that means that the default on a docroot is a allow from all?

yes
that's typically how apache is set up
deny from the root and open up specific directories on the file system...
where specific directory is the docroot

I would like to rewrite an url only when a certain ip range accesses it, but I'm not sure how, mod_rewrite does not have a variable for the requester's ip

it does
%{REMOTE_HOST}
something like that

rewritecond

rewritecond is http://httpd.apache.org/docs/2.0/mod/mod_rewrite.html#rewritecond

I'm not sure I get the problem with links and proxy_html
I'm doing ProxyPass / http://host.lan:8888/
hence links should be already valid, no?

i really recommend a reverse proxy

yeah

possibly

instead

i don't use forward proxies... bad for security, etc...

what do you mean? I'm doing ProxyPassReverse / http://host.lan:8888/ too

whats the difference?

yeah, sorry, I dont understand either

Roobarb-Work: for the default vhost, you mean?

I'm doing the same thing as on that page but for /webapps being /

no, forward/reverse proxy types

to be clear: even if there aren't any access control on my docroot, apache automatically sets a allow-from-all to it even when / has been set to deny-from-all ?

cause that is what happens here..

don't answer that - I just read the mod_proxy docs

Roobarb-Work: ServerName *.foo will not work anyways.. I think.. Serveralias *.foo will

if the subdir is in your docroot, it will inherit options and access from the docroot directory

I think.
Roobarb-Work: hm?

http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#access

not sure - ServerName *.example.com isn't documented

Roobarb-Work: ok, and which ServerName would you use?

it tells your right there

going-home time methinks

forward proxies allow anyone access to arbitrary hosts.
reverse proxies only allow access to what's specifically configured...
depending on how you access control your proxy...

you guys ever heard of apache synapse or use it?

for a _default_ it doesn't matter
in fact, _default_ uses the main servername

Roobarb-Work: can I omit that param altogether?
ok

anyway, I'm off - later all

later

and if there aren't any set on the docroot it inherits the access control form the next directory further up in the hirachy which has access controls set?

bah, I dont get it. now it's working alright with proxypass, without the proxy_html thing

but links points to host:8888, which I'm proxying
that will work but it defeat the point
defeats*

*shrugs* up to you...
if you don't get it, you don't get it... go with what works for you...
something like that...

I'll do more readings and get it then
later

Guys, can you point me to info regading setting up webdav for file sharing supporting access control for different folders ? meaning each folder for specific project with access by distinct teams ??

k - thanks

that sounds like.. quite some fun... like.. pathbased/group-based configuration for svn.. only without svn.

got it

heh

thanks again

Im really stuck here, I have 3 vhosts with the configs copied directly from a working setup. Its not distinguising between the 3 vhosts its just serving the firt vhost on the list :-S I got the configs from a ubuntu machine and the one Im setting up is on debian. any ideas? http://rafb.net/p/wK3VwV65.html. You wont be able to see it unless you connect to my dns, all the .co.uk's have gone haywire

err I guess so.. are you suggestion I use SVN for that purpose ?

I'm not. My only experience with WebDAV comes from Subversion.

No! jMCg is to blame!

you need NameVirtualHost * defined somewhere
fajita++
faq1

exactly. For example, NameVirtualHost *:80 must be used with VirtualHost *:80

oh I see, well I have a webdav serving flies but I need to segregate acess for areas for different projects....

i'm getting log entries in the non-ssl log in the common log format whenever there's a ssl hit

webdav serving flies ??!? eheh not so... serving FILES ....!

don't make the flies angry...

i've checked the configuration files and there are no CustomLog entries

I do that [for Subversion] with mod_authn_dbd like.. this...

look for transferlog

8 +0100] "GET /apache_pb22_ani.gif HTTP/1.1" 304
8 +0100] "GET /apache_pb22_ani.gif HTTP/1.1" 304 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219
8 +0100] "GET /apache_pb22_ani.gif HTTP/1.1" 304 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219

by default ssl should be logging to a transfer log... this is usually set in your ssl vhost

and I get double wntries when I activate the combined log

you should get https requests logged to access and the transfer log...

I didn't get whatever you pasted....

could take a while.. because I'm just pulling out of my ass, because I don't have the configs at hand.

ok i've found it
can i change the transfer log to the combined format?

good question... dunno really
never thought about that...
tias

tias is Try it and See - if you want to know if something will work, give it a go. If not, then you can ask why it didn't work as expected

sure you can

megaspaz:BRILLIANT!!!

the docs say it uses the most recent LogFormat directive

does the [

what's the point of having a TransferLog *and* a CustomLog directive?

does the [R] flag on the end of a RewriteRule cause the url to get rewritten in the user's browser?

there's no point.
if they are in same context

e.g. RewriteRule ^http/\/mysite.com\/(.*)$ http://www.mysite.com/$1 [R]

..unless you do customloggin based on some env variable and TransferLog for all requests of course. just depends on your requirements...
RewriteRule does not see schema://host

alll right, thank you

only the /url-path
probably checking and fixing your log files for each context (server, virtualhost) solves your problem

how can i cause mysite.com to get updated in the users broswer to www.mysite.com?

http://apache.pastebin.ca/561874 this is the basic idea of how things might work or terribly bread

thanks I'll have a look now

better solution would be own vhost for mysite.com and redirecting from there
or then use RewriteCond based on %{HTTP_HOST}
RewriteCond?

RewriteCond is http://httpd.apache.org/docs/2.0/mod/mod_rewrite.html#rewritecond

Is there a built-in way to have the Apache Monitor start but not start the server (just sit in the system tray) ?

interesting module, now I wonder how do you hmmm define the access rules into the database ? manually or do you have a front-end ??

Jinx, it does not start the service at all
windows does
use the windows service mangerment tools

well when i disabled the service, it didn't start the monitor either

set the startup method to manual

yes, i'm familiar with services
but it seemed to be linked since disabling the server service also disabled the manager
i assume the easiest solution is just to shove the monitor in Startup?

i do it mostly manually in the frontend and with a webinterface in the database.

what web interface ?? phpMyadmin ?

i have a name based vhost problem. 2 vhosts work okay by fqdn

self-hacked.

if someone browses by hostname on our lan, they only ge the default webroot

but sure.. you can use phpMyAdmin as well..
if you like PHP or MySQL....

but what do you use ? oh and BTW the database tables for access control was supplied/ specified by the module, or you did it yourself ?

both. The module expects the name of the table returned to be username and password, IIRC, so either you name it like that, or you say select foo as bar
s/table/column/

yeah i got it

is it possible to supply 2 names or a regex in the vhost definition so it matches on trac* instead of trac.my.com
i checked the docs, it and didnt appear so, but i cannot be the only person to hit this.
i bet mod_rewrite might be able to handle this

hi guys. im trying to compile mod_jk against apache-2.0. i run configure --with-apxs=/path/to/apxs but configure fails with a configure: error: You must specify a valid --with-apxs path
running ls /path/to/apxs shows apxs is there.

maybe, there's a --with-apxs2 flag... php does this, so who knows...

megaspaz, ah. of course.

http://rewrite.drbacchus.com/rewritewiki/VirtualHost

thx rici

using webmin/virtualmin with linux fc7/apache 2.2.4 : Checking pingability.com for mindlabstudio.com I get... Error There was a problem while talking with the mail server. Got 'Connect Exception: Connection refused'
I know this is a mail server issue.
I have registrar pointing to zoneedit
but I also have to have the MX record set up on my Bind right?

now make fails with a libtool:specify a tag with `--tag'

i want to solve that f***ing svn problem... and it seems that all people who answer people with the same question just want to bubble lots of stuff without really solving the problem
mod_dav_svn especially

Getty, what's the problem?

SVNParentPath as / of a VHost
http://svn.domain/repository-name/

mkay, i have that

how?
gimme config
http://svn.domain/svn/repository-name/ is easy but you remove the paths it easily doesnt work
i COULD make one location for any SVN, then it also would work

doesnt work

Look buddy, doesn't work is a strong statement. Does it sit on the couch all day? Does it want more money? Is it on IRC all the time? Be specific! Examples of what doesn't work (or the URL) tend to help too,)pastebin the config if that's the problem

Getty, does here.

there is a problem then, which leads into a 302 moved permanently
here not, show me your apache config

looks ok...
i have a dev who has been committing things for the past 5 days - i think he would have caught an issue by now..
yeah hold on
Getty, http://pastebin.ca/561973

is that in a vhost?
ah wait!
SVNPath
i talk about SVNParentPath
you talk about ONE repository
i talk about a ParentPath, which includes several SVN

oh, i see.
its not a vhost, no.
that 302 thing, try defining a 404 page like i did. 302 sounds vaguely familiar.

no do you know what this 302 is?

how much does reloading apache affect users?

http://svn.domain/bla/

svn checkout http://svn.domain/bla/
but he tries http://svn.domain/bla
and this gives a 302 to http://svn.domain/bla/

Getty, google 302 and 404 -- i cant remember what the deal was there.

and then svn client drops out
doesnt care
its logical working
if you use a webclient it works just fine

302

Moved Temporarily

yeah

404

404 is Not Found

yeah
i know
and?
doesnt remove the problem

what's the problem?
svn client won't follow 302s?

http://paste.debian.net/30322

http://svn.haxx.se/users/archive-2005-07/0233.shtml

What do you recommend on Linux? Postfix or Sendmail?

still a (loosy) solution for SVNPath, nothing on SVNParentPath
dont use sendmail

mindlab, postfix
Getty, try it and see if helps. it's one line.

so back to the problem
what lie?

a lie repeated often enough can become truth.

kk cuz having all sorts of issues with postfix.. can send fine, but not receive.

line?

line is "Options +Multiviews". That's one line. And it's the right way to do it. Best of both worlds.

there is nothing in there which is my problem
i set it in wait
but there is no 404 so why this solve it?

Getty, does it work?

nope
now i get 301

lol

ah no i always get 301

cant telnet into domain.com 25 and it's opened up on the router firewall.. and I am 99% positive I opened it right with iptables.

just mixed them up

lol

mindlab, are you in the right chan, dude?

our getty

lol
whatever, the problem still there....
and no solutions so far

tried #svn?

just bad words there

i don't dare to ask, but what problem anyway?

the guys there have no idea of apache mainly
easy..
http://paste.debian.net/30322

postfix That channel doesn't exist

pam auth?

O_o

da nimmt man doch sasl (hahahaha)
ups, sry for german

aber nur mit Dovecot.

exim

exim is tsnarfing sargeur's port 80, pc_tony. Also, he's looking for a way to see which vhosts's php scripts are sending mail
uexim is tsnarfing sargeur's port 80, pc_tony. Also, he's looking for a way to see which vhosts's php scripts are sending mail/u

pam auth? yes pam_auth
its winbind behind the pam
do you know what is behind my pam?

winnie?

winnie
AD
real power

ah, exchange loser

scary...

yes
outlook

Outlook? You mean OutBREAK, don't you?

no, i got good windows admins i feel save

well as strange as it may sound, same here
the C?Os wanted outlook as calander
what only works with exchange

but i would prefer to talk about my fucking SV
N

what only works with AD

yeah here too
and i like it
cause we use it really "cool"
productive
i setup a task in outlook and the administration works them out

well as strange as it may sound, exchange really works

yeah

scary

and if you got good admins (i got them) then is all fine
no intruder or virus since company founding, so i can feel save

you "got good windows admins" ? so.. what do you do ?

so i don't admister my dovecot anymore

i fixed it woithout mod rewrite, i just added two vhosts for same docroot, one as fqdn and anohter as just hostname. seems to work ok

not working in their section
i'm project leader of the PHP/WebDevelopment Crew

by the way, i have no clue about your little snv / dav prob

yes, if you only have two you could use ServerAlias

but you understand the problem?

is that an official sickness?

its money producing

Hello. Can anyone point me at a URL that shows how to do directory level authentication based on a certificate, not userfile ?

then it follows that they don't work in yours, either- so what do you need windows admins *for* ?

hrhr

that may be better. i will look at that

we got CHIP, Connect and lots of other big clients
without PHP this contracts would never been done

nope, i'm just recovering from a 50% power outage
need some mental rest
and recovery

and you're allowd to do... Apache stuff, too?

chip, wonder if we host chip in munic
maybe some parts

yes?

heh

i do everything i want to, and what i dont want i give to the admins
would be cool if you know
if you host them, i could need that contact probably some day
we opening a "workgroup" together with CHIP now, to get the coding power of them to us too

yes, serveralias is a much better soln.. thx.

whatever i need that fucking svn setup like i want to....
i guess i will rewrite
can someone make me the rewrite rule?

/svn/* ?

hmm some weird rewrite or redirect? cause lynx gets 200 and svc 301

no no the 301 is clear but i dont want it

RedirectMatch / /svn/

http//svn.domain/svn/

checking mom

why on hell's earth don't you configure subversion like any sane person out there in Location ?

it has NOTHING todo with Location or Directory

check on the svn archive of the mailingliste and stuff: it DOESNT work, doesnt care what you do

all Rewrite would be

if you do Location /svn it works, if you do Location / it doesnt

hi...

hi is there a feature in apache to limit incoming bandwidth to certain virtual sites? or should i be looking at squid for this type of task?

oops hold

(we talk about SVNParentPath!!! NOT SVNPath! that works fine in both cases)

hi!

hello! How are you today??

what is the feature I should be looking ad? that one that displays a index.pt for potytuguese, a index.pl for plish a index.en

hm... URL [to the mailinglist], and what version are we talking about?

redirectmatch doesnt work
i get some error

hmm dunno, brain empty

no idea, its a problem that is written in many threads

I'm sure someone has solved this problem before. Hoe do I examine all apache config files for a directive?

http://svn.haxx.se/users/archive-2006-02/0829.shtml
a href="http://svn.haxx.se/users/archive-2006-02/0829.shtml"http://svn.haxx.se/users/archive-2006-02/0829.shtml/a

I was/am trying to write a recursive bash script, but it's driving me mad. :-)

then you did something else then i did

*.conf

its really amazing how all people say that this what i want should work, but noone ever really tried it....

We have vhosts and include files located on SAN.

if you REALLY got a problem on IRC you are REALLY lost, cause noone believes you

I'm working with SVNParentPath.

and marvel at the wonders that are recursive grep.

then show me your vhost config for that

That won't hit SAN includes.

so mount up and greppeth them all.

gimme a sec

I have 230 servers. :-)

have you tried mod_info ?

Me?

yes

use ssh remote commands

No, never heard of it?

it can show you apache's view of the config

Is that commonly compiled into apache 1.3.6?

Can anyone point me at a URL that shows how to do directory level authentication based on a certificate, not userfile ?

mod_ssl

mod_ssl is http://httpd.apache.org/docs-2.0/ssl/ or http://www.modssl.org/ (for 1.3) or http://httpd.apache.org/docs-2.0/mod/mod_ssl.html or http://cvs.apache.org/~mads/ac2004/MO18mod_ssl.pdf or see mod_gnutls for an alternative

1.3.6 ???

was that for me?

yeah

Yep, that's what we use.

but it's not what i wanted
sslengine

sslengine is http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslengine http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#sslengine

ok, i retract the suggestion
i have no idea

:-)

http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslverifyclient

well, that is close to what we want, I don't know if what I want to do is possible
Say I have 2 users.

13 years later.... ;-)

sure sounds like that's what you want

Can I set up one vhost, one IP. Give one user access to /foo in that vhost, and the other user to /bar, but prevent them from seeing each other's directory?

the goal is the value of all ServerName directives?

I have the sslverifyclient, and I have the 'site' working with 1 user, but we can't let user 2 see the files in the directory for user 1

yephttp://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslusername
bah

humbug

http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslusername
or maybe not
well possibly with setenvif

it ran configure fine and now it stopped. makes no sense whatever.

ok, you've confused the hell out of me
sorry, I'm a light weight apache admin who's being thrown into this

Looking for all places where authorization might be specified.

I'm adding some comments http://apache.pastebin.ca/562038

hmm, sslverifyclient is appropriate for a directory block according to the first url you gave me

can be replaced with VirtualHost _default_:443

bu can we I specify more than one client cert

well that's handled by your CA Cert that signed the cert...

unless you have half a ton of IPs, then specify the IP:443, I suppose you know the drill.

but for what you want to do, it's not something that can be done without a lot of thought and hackery
sslcacertificatefile

sslcacertificatefile is Fhttp://httpd.apache.org/docs-2.0/mod/mod_ssl.html#sslcacertificatefile

sslcacertificatefile context

server config, virtual host

bummer

so the rewrite rules does the trick?

block?

haeh?

yeah that was the beginning
i dont see the gimmick why it works for you and not for me

nah.. the rewrite is just for Trace Paranoia

then i dont get the difference, then your setup works with your mod_dav_svn

maybe because of my fancy LimitExcept/Limit crap.

you think?
i try it

I'm not gonna touch this shit before i don't migrate and then only with heavy ass testing.

setenvifnocase context

server config, virtual host, directory, .htaccess

hmmm

no luck, same error

we're talking of Location / and not of directory /some/weird/shit/that/I/ve/not/seen/in/the/subversion/docs/ever

its already back to location

possibly in a directory block... Setenvifnocase SSL_SERVER_S_DN_x509 "subject from the cert" allow_me=1

sample url

as i said, i tried at first with location
that directory was just a test between
its internal

and then do your sslverifyclient and do an allow from allow_me

Yeah.. just saw that.

sslverifyclient context

server config, virtual host, directory, .htaccess

yeah

ah wait, there was a "rest" of some bad test in it
checking again
nope, still that 301

what'd you get in error log, btw?

error log? nothing
if i access the page with a webbrowser it works fine
cause the 301 is a regular redirect and i get the repository

http://apache.pastebin.ca/562054 is what i'm thinking...

heya, anyone could help me setting a vhost on localhost (if it's possible to have like http://alt.localhost/) ?

just the svn client brakes on it... which is... not purpose
could be that tortoise also ignores that problem
and just the console svn client has that problem with the construct

but, that's just a guess...

so, could I set SSLVerifyClient require in both /directory, then SSLUserName = to the SSL_SERVER_S_DN in each /directory as needed?

uhm.. .why do you get the redirect anyways O_o

and possibly the sslverifyclient needs to before the setenvif

cool, I was thinking along the right direction atleast

yeah, that's what i was thinking... do something like this for each user

i do http:///svn/ (i drop the host now for faster talk), the svn client tries then: http:///svn and this 301 to http:///svn/
regular browser would follow and all is fine, svn client doesnt

but i'm not sure on the setenvifnocase... if that's the right env variable...
and again... maybe switch line 2 and 3 around...

argh!

can I specify SetEnvIfNocase multiple times?

okay... wtf does http:/// mean?

http://host/

just incase we find two users needing the same dir? (thinking ahead)

has anyone been able to compile the latest mod_jk against apache2?

-_-;;;

for the guys without inspiration
(and with anime smilies).....
i explained it with the (...) sentence... seems hard to read

Related Topic: