Category: Apache

Determine Most Active Site

October 15, 2013

On a server with many domains it can be difficult to determine which sites are taking the most traffic. Here’s a one-line that will generate a nice report:

find /var/log/httpd/ -name '*access.log' | \
   xargs grep --color `date +%d/%b` | \
   cut -d: -f1 | uniq -c | sort -n -r

find /var/log/httpd/ -name '*access.log' | \

xargs grep --color `date +%d/%b` | \

cut -d: -f1 | uniq -c | sort -n -r

This assumes that (a) log files are in /var/log/httpd, (b) log file names end with “access.log” and that each domain has it’s own access list.

Block By X-Forwarded-For In .htaccess

October 14, 2013

To block access except for a single IP address in the .htaccess file the code is:

order deny,allow
deny from all
allow from 1.1.1.1

order deny,allow

deny from all

allow from 1.1.1.1

If you’re behind a load balancer then you have to use the X-Forwarded-For header instead:

Order Deny,Allow
Deny from all
SetEnvIf X-Forwarded-For "^1\.1\.1\.1" AllowAccess
Allow from env=AllowAccess

Order Deny,Allow

Deny from all

SetEnvIf X-Forwarded-For "^1\.1\.1\.1" AllowAccess

Allow from env=AllowAccess

Reverse Proxy For eScan Web Control Panel

May 29, 2013

Recently I installed “eScan for Linux Servers” on one of our client’s server. eScan has a great Linux virus scanner. In addition to a command line utility, it provides a web interface. The web interface runs on port 10443 by default. The problem is the client’s server was firewalled and I didn’t want to open a new port just for eScan. So I setup a reverse proxy in Apache on a virtual hosts. It got interesting when I discovered that the web interface was embedding internal urls in to the content so I had to add mod_filter and mod_substitute. Here’s the final config:

LoadModule filter_module modules/mod_filter.so
LoadModule substitute_module modules/mod_substitute.so
<VirtualHost *:80>
        ServerName av.acme.com:80
        UseCanonicalName on
        SSLProxyEngine on
        ProxyPass / https://localhost:10443/
        ProxyPassReverse / https://localhost:10443/
        ErrorLog logs/av.acme.com-error_log
        CustomLog logs/av.acme.com-access_log common
        ProxyPreserveHost on

        # declare that content should be filtered through mod_substitute
        FilterDeclare NOLH
        FilterProvider NOLH SUBSTITUTE resp=Content-Type $text/html
        FilterChain +NOLH

        # replace local urls with remote
        Substitute "s|https://127.0.0.1:10443|http://av.acme.com|in"

        <Location / >
                AuthType Basic
                AuthName "Restricted Files"
                AuthUserFile /etc/httpd/conf.d/av.passwd
                Require user admin
        </Location>
</VirtualHost>

LoadModule filter_module modules/mod_filter.so

LoadModule substitute_module modules/mod_substitute.so

ServerName av.acme.com:80

UseCanonicalName on

SSLProxyEngine on

ProxyPass / https://localhost:10443/

ProxyPassReverse / https://localhost:10443/

ErrorLog logs/av.acme.com-error_log

CustomLog logs/av.acme.com-access_log common

ProxyPreserveHost on

# declare that content should be filtered through mod_substitute

FilterDeclare NOLH

FilterProvider NOLH SUBSTITUTE resp=Content-Type $text/html

FilterChain +NOLH

# replace local urls with remote

Substitute "s|https://127.0.0.1:10443|http://av.acme.com|in"

AuthType Basic

AuthName "Restricted Files"

AuthUserFile /etc/httpd/conf.d/av.passwd

Require user admin

</Location>

</VirtualHost>

Similar configuration could be used to map other odd-port web interfaces into a virtual host.

Discourage HTTPS On WordPress

January 16, 2013

Recently we had a WordPress site where that used HTTPS (SSL) on the login/admin areas. But we wanted to discourage HTTPS for non-admin URL. Here are the rewrite rules that ended up using in a .htaccess file:


RewriteEngine On
RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} !^\/wp\-admin
RewriteCond %{REQUEST_URI} !^\/wp\-login.php
RewriteCond %{REQUEST_URI} !^\/wp\-includes
RewriteCond %{REQUEST_URI} !^\/wp\-content\/plugins
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [R,L]

RewriteEngine On

RewriteCond %{HTTPS} on

RewriteCond %{REQUEST_URI} !^\/wp\-admin

RewriteCond %{REQUEST_URI} !^\/wp\-login.php

RewriteCond %{REQUEST_URI} !^\/wp\-includes

RewriteCond %{REQUEST_URI} !^\/wp\-content\/plugins

RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [R,L]

Block PHP Execution With .htaccess In Folder

January 5, 2013

For a server using Plesk add the following lines to a .htaccess file to stop execution of PHP scripts in the folder:


RemoveHandler .php .phtml .php3
RemoveType .php .phtml .php3
php_flag engine off

RemoveHandler .php .phtml .php3

RemoveType .php .phtml .php3

php_flag engine off

I like to use this to protect cache and image upload folders that are writable by the web server but should not be able to execute code. As a further precaution, chown the .htaccess to root, so it can’t be overwritten by Apache or FTP, and “chattr +i” to be sure about it.