Archive for category apache

Apache 2.4 log level config

In the new apache 2.4 it is pretty cool to configure the logging via module.

LogLevel warn ssl:error auth_digest:error socache_shmcb:warn mpm_worker:warn fcgid:info

mod_fcgid is crashing apache windows and linux

With apache 2.3.15 I had kinda  the same issue with mod_fcgidon ubuntu 8.04 as on windows.  With -k restart or -k graceful the server did not die like on windows, but the server delivered than only a 200 OK response header, but nothing more. Switching from worker mpm to event mpm seemed to solve this, but the server died later :-/

Since it has talmost the same issues like on windows I could make a patch that fixes this. Grab the patch (patched against trunk) for the patch for 2.3.6

The bug 50309 is now longer than a year listet. Bad that none applied it yet.

Tags: , , , , , ,

Secure apache against CVE-2011-3389 aka Beast attack

During the summer rumours about a new attack against SSL started circulating (CVE-2011-3389).
As it turns out, the attack itself was conceived years ago, deemed impractical, but it was nevertheless fixed in TLS 1.1. The new attack technique introduced a few optimizations to make it practical.

In terms of mitigation, I expect this problem will be largely addressed on the client side, despite a potential compatibility problem that may cause some TLS sites to stop working.

With this config you can avoid that attack.

SSLProtocol all -SSLv2
SSLHonorCipherOrder On
SSLCipherSuite ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM:!SSLV2:!eNULL

#NO Longer needed cause since IE 7 this works ;) 
#SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown

With OpenSSL 1.0.1 it must be

SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH

Tags: , , , ,

YSlow Etag misconfigured

YSlow hat gemeckert, dass der Etag misconfigured / falsch gesetzt sei.

Um das zu ändern muss man

FileEtag All

ändern zu

FileETag MTime Size

 

Wenn dann noch bei einzelnen Dateien fehler auftreten, wie z.B. dem favicon.ico fehlt der korrekte mime type.

Addtype font/truetype .ttf
AddType image/x-icon .ico

 

etags

Tags: , , , ,

Apache AJP reverse proxy

With apache it is possible to have a reverse proxy with AJP instead of http. With the use of mod_proxy_ajp it is very simple to set up and faster than just plain http protocol

<VirtualHost *:80>
    ServerName jenkins
    DocumentRoot "/mario/Apache22/htdocs"
    <Directory "/mario/Apache22/htdocs">
        Options Indexes Includes FollowSymLinks
        AllowOverride All
        Order Allow,Deny
        Allow from all
        Deny from none
    </Directory>
    <Location />
        ProxyPass ajp://localhost:8009/
        ProxyPassReverse ajp://localhost:8009/
    </Location>

    SetEnv vhostname jenkins
    Header add X-Server-Name %{vhostname}e
</virtualhost>

Than start the backend server, in this case only with AJP and listen only on localhost

java -jar jenkins.war --httpPort=-1 --ajp13ListenAddress=127.0.0.1

Tags: , , , , , ,

Building 2.3.12 beta

./configure –prefix=/opt/apache2 –enable-pie –enable-mods-shared=all –enable-so –disable-include –enable-deflate –enable-headers –enable-expires –enable-ssl=shared –enable-mpms-shared=all –with-mpm=worker –enable-rewrite –with-z=/home/mario/apache24/httpd-2.3.12-beta/srclib/zlib –enable-module=ssl –enable-fcgid
make
sudo make install

 

cd ../fcgid
APXS=/opt/apache2/bin/apxs ./configure.apxs
make
sudo make install

configure apache 2.3 build

./configure –prefix=/opt/apache2 –enable-pie –enable-mods-shared=all –enable-authn-dbd –enable-so –disable-include –enable-deflate –enable-headers –enable-expires –enable-ssl=shared –enable-mpms-shared=all –with-mpm=worker –enable-rewrite –with-z=/home/mario/apache24/httpd-2.3.11-beta/srclib/zlib –enable-module=ssl –enable-fcgid

for fcgid

APXS=/opt/apache2/bin/apxs ./configure.apxs

Tags: , , , ,

mod lua error handling sux

I still dislike the 500 error handling in lua. Well scripting got easier with practicing :P But the error handling realy sux a lot compared to PHP where I come from. I made a bit “benchmarking”. OK I took very different scripts, but PHP seems faster to me than lua. Plus for lua is that you are able to write direcly into apache log files.

Tags: , , ,

first script for mod_lua apache2.3/2.4

function handle(r)
	r.content_type = "text/html"
	--r.headers_out["X-Powered-By"] = "mod_lua; " .. _VERSION
	r:puts("Hi!")
	return apache2.OK
end

Mod lua expects a function with the name handle() else there is a 500 Error. The error handling is pretty anoying…

Tags: , , , ,

compile lua on windows

Grab the “newest” (2008) http://www.lua.org/ftp/lua-5.1.4.tar.gz
unpack it. Compiling with VC++ is very easy.

Open the x64 %comspec% /E:ON /V:ON /T:0E /K “C:\Program Files\Microsoft SDKs\Windows\v7.0\Bin\SetEnv.cmd” /Release
or x86 command line
%comspec% /k “”C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\vcvarsall.bat”” x86

browse to lua folder and run

etc\luavs
copy /y src\*.* .\

Done!

Tags: , , , , ,

Archives by Subject:

Archives by Month: