Category: Webservers

Determine Most Active Site

October 15, 2013

On a server with many domains it can be difficult to determine which sites are taking the most traffic. Here’s a one-line that will generate a nice report:

find /var/log/httpd/ -name '*access.log' | \
   xargs grep --color `date +%d/%b` | \
   cut -d: -f1 | uniq -c | sort -n -r

find /var/log/httpd/ -name '*access.log' | \

xargs grep --color `date +%d/%b` | \

cut -d: -f1 | uniq -c | sort -n -r

This assumes that (a) log files are in /var/log/httpd, (b) log file names end with “access.log” and that each domain has it’s own access list.

Block By X-Forwarded-For In .htaccess

October 14, 2013

To block access except for a single IP address in the .htaccess file the code is:

order deny,allow
deny from all
allow from 1.1.1.1

order deny,allow

deny from all

allow from 1.1.1.1

If you’re behind a load balancer then you have to use the X-Forwarded-For header instead:

Order Deny,Allow
Deny from all
SetEnvIf X-Forwarded-For "^1\.1\.1\.1" AllowAccess
Allow from env=AllowAccess

Order Deny,Allow

Deny from all

SetEnvIf X-Forwarded-For "^1\.1\.1\.1" AllowAccess

Allow from env=AllowAccess

Reverse Proxy For eScan Web Control Panel

May 29, 2013

Recently I installed “eScan for Linux Servers” on one of our client’s server. eScan has a great Linux virus scanner. In addition to a command line utility, it provides a web interface. The web interface runs on port 10443 by default. The problem is the client’s server was firewalled and I didn’t want to open a new port just for eScan. So I setup a reverse proxy in Apache on a virtual hosts. It got interesting when I discovered that the web interface was embedding internal urls in to the content so I had to add mod_filter and mod_substitute. Here’s the final config:

LoadModule filter_module modules/mod_filter.so
LoadModule substitute_module modules/mod_substitute.so
<VirtualHost *:80>
        ServerName av.acme.com:80
        UseCanonicalName on
        SSLProxyEngine on
        ProxyPass / https://localhost:10443/
        ProxyPassReverse / https://localhost:10443/
        ErrorLog logs/av.acme.com-error_log
        CustomLog logs/av.acme.com-access_log common
        ProxyPreserveHost on

        # declare that content should be filtered through mod_substitute
        FilterDeclare NOLH
        FilterProvider NOLH SUBSTITUTE resp=Content-Type $text/html
        FilterChain +NOLH

        # replace local urls with remote
        Substitute "s|https://127.0.0.1:10443|http://av.acme.com|in"

        <Location / >
                AuthType Basic
                AuthName "Restricted Files"
                AuthUserFile /etc/httpd/conf.d/av.passwd
                Require user admin
        </Location>
</VirtualHost>

LoadModule filter_module modules/mod_filter.so

LoadModule substitute_module modules/mod_substitute.so

ServerName av.acme.com:80

UseCanonicalName on

SSLProxyEngine on

ProxyPass / https://localhost:10443/

ProxyPassReverse / https://localhost:10443/

ErrorLog logs/av.acme.com-error_log

CustomLog logs/av.acme.com-access_log common

ProxyPreserveHost on

# declare that content should be filtered through mod_substitute

FilterDeclare NOLH

FilterProvider NOLH SUBSTITUTE resp=Content-Type $text/html

FilterChain +NOLH

# replace local urls with remote

Substitute "s|https://127.0.0.1:10443|http://av.acme.com|in"

AuthType Basic

AuthName "Restricted Files"

AuthUserFile /etc/httpd/conf.d/av.passwd

Require user admin

</Location>

</VirtualHost>

Similar configuration could be used to map other odd-port web interfaces into a virtual host.

ServerAlias On Nginx

May 23, 2013

On Apache web servers, each virtual host has a “ServerName” directive and zero or more “ServerAlias” directives. When converting to Nginx there is only one directive – “server_name” which takes the place of both of the Apache directives. The “server_name” directive takes a set of space delimited arguments listing domains that should match the virtual host. So for example if you have this Apache config:


ServerName acme.com
ServerAlias www.acme.com
ServerAlias acmeinc.com www.acmeinc.com

ServerName acme.com

ServerAlias www.acme.com

ServerAlias acmeinc.com www.acmeinc.com

Then for Nginx use:


server_name acme.com www.acme.com acmeinc.com www.acmeinc.com

server_name acme.com www.acme.com acmeinc.com www.acmeinc.com

This is a simple example for full details see this page in the Nginx documentation: http://nginx.org/en/docs/http/server_names.html

Trustwave Certificate Chain

April 25, 2013

Had to install an SSL certificate from Trustwave today. The cert was emailed to the customer in a zip file. that contained several formats. For plesk the “.cer” file is the one that we needed. Also for the CA certificate there was a “chain.cer” file. Unfortunately Plesk (Apache) was not happy and complained that the private key did not sign the certificate. This indicates a problem with intermediate certificates. Using the commands given here: View Contents Of SSL Certificate I looked at the certificate and found that it was signed by: C=US, ST=Illinois, L=Chicago, O=Trustwave Holdings, Inc., CN=Trustwave Organization Validation CA, Level 2/emailAddress=ca@trustwave.com The certificate in the chain file was for: C=US, ST=Illinois, L=Chicago, O=Trustwave Holdings, Inc., CN=Trustwave Organization Validation CA, Level 2/emailAddress=ca@trustwave.com and it was signed by: C=US, O=SecureTrust Corporation, CN=SecureTrust CA but there was not certificate for this signer. I found the TrustWave roots here: https://ssl.trustwave.com/support/support-root-download.php Turns out