Category: Webservers

Fixing “504 Gateway Timeout” Errors On Plesk With Nginx

April 15, 2014

If your Plesk server is configured to run Nginx in from of Apache then you may encounter “504 Gateway Timeout” errors when executing long running PHP pages. Nginx is acting as a reverse proxy for Apache. The “proxy_read_timeout” configuration setting in Nginx controls how long Nginx will wait for Apache to return a response. The default is 60 seconds which may be too short if you have a script that takes several minutes to run. To increase this timeout, just edit /etc/nginx/nginx.conf and add the highlighted line:

    server_tokens off;

    proxy_read_timeout 300;

    include /etc/nginx/conf.d/*.conf;
}

server_tokens off;

proxy_read_timeout 300;

include /etc/nginx/conf.d/*.conf;

}

Don’t forget to restart Nginx after making the change.

Score An “A” On SSLLabs Server Test

April 13, 2014

Want an A on the SSLLabs server test? https://www.ssllabs.com/ssltest/ For Plesk create a file here:

/etc/httpd/conf.d/zz050-psa-disable-weak-ssl-ciphers.conf

1	/etc/httpd/conf.d/zz050-psa-disable-weak-ssl-ciphers.conf

and add the following:

SSLProtocol all -TLSv1 -SSLv2
SSLHonorCipherOrder on
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \
EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 \
EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"

SSLProtocol all -TLSv1 -SSLv2

SSLHonorCipherOrder on

SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \

EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 \

EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"

For WHM/CPanel do this: a. go to Service Configuration -> Apache Configuration -> Global Configuration and set “SSL Cipher Suite” to:

+ECDHE:+DHE:HIGH:!DHE-RSA-AES128-SHA:!ECDHE-RSA-AES128-SHA:!MD5:!ADH:!aNULL:!eNULL:!EXP

1	+ECDHE:+DHE:HIGH:!DHE-RSA-AES128-SHA:!ECDHE-RSA-AES128-SHA:!MD5:!ADH:!aNULL:!eNULL:!EXP

b. go to Service Configuration -> Apache Configuration -> Include Editor -> Pre Main Include and add the following lines:

SSLHonorCipherOrder On
SSLProtocol ALL -TLSv1 -SSLv2
# CVE-2011-3389
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown

SSLHonorCipherOrder On

SSLProtocol ALL -TLSv1 -SSLv2

# CVE-2011-3389

SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown

For a standalone Apache server try these:

SSLProtocol all -TLSv1 -SSLv2
SSLHonorCipherOrder on
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \
EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 \
EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"

SSLProtocol all -TLSv1 -SSLv2

SSLHonorCipherOrder on

SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \

EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 \

EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"

For Nginx try these lines:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \
EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 \
EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_prefer_server_ciphers on;

ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \

EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 \

EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";

If you get capped at a B due to TLS Compression support you can add:

SSLCompression off

1	SSLCompression off

For older Apache versions this setting may not be available. In this case you can edit the init script (/etc/init.d/httpd) and add this line:

export OPENSSL_NO_DEFAULT_ZLIB=1

1	export OPENSSL_NO_DEFAULT_ZLIB=1

Qualys has a blog post on this subject which provided the Apache and Nginx configs: https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy This forum post provided the WHM/Cpanel config: http://forums.cpanel.net/f185/cpanel-openssl-1-0-1c-higher-332001-p3.html#post1561101

GoAccess Web Log Analyzer

April 11, 2014

Here’s a great webserver log analysis tool. It’s lightweight, fast and runs from the command line on Linux: http://goaccess.prosoftcorp.com/ Just download, build and run with something like:

goaccess -f /var/log/httpd/access_log

1	goaccess -f /var/log/httpd/access_log

I also like generating an HTML report with something like:

cat /var/log/httpd/access_log | goaccess -a > report.html

1	cat /var/log/httpd/access_log \| goaccess -a > report.html

Block wp-login.php On Single Site In WordPress Multisite

April 4, 2014

Take the case where you have a WordPress multi-site with many domains pointing to a single virtual host. When the site gets hit with a wp-login.php attack you want to password protect the wp-login.php script but just for the targeted site … not for every site in the multisite. Here’s the .htaccess rules to accomplish this:

SetEnvIfNoCase Host "acme.com" requireauth=1
SetEnvIfNoCase Host "widgets.com" requireauth=1

<Files ~ "^wp-login.php">
    AuthType Basic
    AuthName "******** ATTENTION - To login please enter username 'admin' and password 'letmein' ********"
    AuthUserFile /etc/httpd/conf/wplogin.htpasswd
    AuthBasicProvider file

    Require valid-user
    Order deny,allow
    Deny from all
    Allow from env=!requireauth
    Satisfy any
</Files>

SetEnvIfNoCase Host "acme.com" requireauth=1

SetEnvIfNoCase Host "widgets.com" requireauth=1

AuthType Basic

AuthName "******** ATTENTION - To login please enter username 'admin' and password 'letmein' ********"

AuthUserFile /etc/httpd/conf/wplogin.htpasswd

AuthBasicProvider file

Require valid-user

Order deny,allow

Deny from all

Allow from env=!requireauth

Satisfy any

</Files>

We set an environment variable based on the Host header and then require login from requests with the matching environment variable.

Remove Authentication From A Subfolder

March 8, 2014

Let’s say you have a directory that is password protected:

<Directory /var/www/vhosts/mysite.com/httpdocs>
AuthName "Login Required"
AuthType Basic
AuthUserFile /etc/httpd/conf/.htpasswd
Require valid-user
</Directory>

AuthName "Login Required"

AuthType Basic

AuthUserFile /etc/httpd/conf/.htpasswd

Require valid-user

</Directory>

Now you want to remove the password protection from a sub-folder like:

/var/www/vhosts/mysite.com/httpdocs/public

1	/var/www/vhosts/mysite.com/httpdocs/public

This can be accomplished by adding another Directory block like this:

<Directory /var/www/vhosts/mysite.com/httpdocs/public>
Allow from all
Satisfy any
</Directory>

Allow from all

Satisfy any

</Directory>

Reliable Penguin provides managed web hosting, systems administration, website and server migrations, and expert consulting.

Recent Updates

Fixing WP‑CLI “eval()’d code” Parse Errors on PHP 8.4 During “wp db import”

Force a 404 With a CloudFront Function (Always)

HTTP Basic Auth Is Dead

WordPress 6.8 Speculative Loading Can Break HTTP Basic Auth

Zero‑Trust for WordPress Admin with Cloudflare Access (Email One‑Time Codes)

Category: Webservers

Fixing “504 Gateway Timeout” Errors On Plesk With Nginx

Score An “A” On SSLLabs Server Test

GoAccess Web Log Analyzer

Block wp-login.php On Single Site In WordPress Multisite

Remove Authentication From A Subfolder

Recent Updates

Categories

Get a free consultation from Reliable Penguin