Re: [us...@httpd] Apache monitor tray icon says running none of 1 Apache service even through it's actually running

2009-06-25 Thread André Warnier
Don Kramer wrote: Hi, I'm running Apache 2.2.11, PHP 5.2.9-2, and MySQL Server 5.1 in 32-bit Windows XP Professional in a VM installed inside VMWare Workstation 6.5.2. I've noticed after booting up the VM, often even through the Apache service is up and running and http://localhost and

Re: [us...@httpd] Setting the Timeout directive to refrain a DoS attacks

2009-06-25 Thread André Warnier
fredk2 wrote: Hi, http://httpd.apache.org/docs/2.2/mod/core.html#timeout says: The TimeOut directive currently defines the amount of time Apache will wait for three things 1. The total amount of time it takes to receive a GET request ... 1. seems to be misleading, tests with Timeout 3 does

Re: [us...@httpd] Performing Internal Certificate Checks

2009-06-25 Thread André Warnier
Eldad Chai wrote: Hi, I am using Apache reverse proxy. I want to perform the following and wondering if it is possible: 1) Extract a field (Subject Name) from a client certificate sent over SSL and compare it to a local list I have 2) Add parts of the certificate to headers or

Re: [us...@httpd] Performing Internal Certificate Checks

2009-06-25 Thread Torsten Foertsch
On Thu 25 Jun 2009, André Warnier wrote: I am using Apache reverse proxy. I want to perform the following and wondering if it is possible: 1)      Extract a field (Subject Name) from a client certificate sent over SSL and compare it to a local list I have 2)      Add parts of the

Re: [us...@httpd] Performing Internal Certificate Checks

2009-06-25 Thread Sean Conner
It was thus said that the Great Eldad Chai once stated: Hi, I am using Apache reverse proxy. I want to perform the following and wondering if it is possible: 1) Extract a field (Subject Name) from a client certificate sent over SSL and compare it to a local list I have 2)

Re: [us...@httpd] Performing Internal Certificate Checks

2009-06-25 Thread Eldad Chai
Thanks for your reply! The user list is stored in a text file. Eldad On Thu, Jun 25, 2009 at 12:08 PM, Sean Conner s...@conman.org wrote: It was thus said that the Great Eldad Chai once stated: Hi, I am using Apache reverse proxy. I want to perform the following and wondering if it

Re: [us...@httpd] Setting the Timeout directive to refrain a DoS attacks

2009-06-25 Thread Eric Covener
On Thu, Jun 25, 2009 at 4:01 AM, André Warniera...@ice-sa.com wrote: - and the arrival of the first byte of the HTTP request itself (the G of GET) I think there's some magic that makes the request line in its entirety subject to the Timeout, instead of each read. -- Eric Covener

[us...@httpd] httpd is creating large number of shared memory segments.

2009-06-25 Thread Chandranshu .
Hi We're running http-2.2.3 with preform MPM and host around 500 sites for many users. We always do a graceful restart of the server lest some users lose their session. The server has created a large number of shared memory segments. We have seen it creating as many as 4030 segments and this

Re: [us...@httpd] Setting the Timeout directive to refrain a DoS attacks

2009-06-25 Thread fredk2
Would'nt you think that a (simple) timer for the header could fend off some of the effect. Can't we assume that if it takes more than 3 second to enter the header we do not want that client (i'll have to learn to type faster in telnet :-). Thanks - Fred awarnier wrote: fredk2 wrote: Hi,

Re: [us...@httpd] Setting the Timeout directive to refrain a DoS attacks

2009-06-25 Thread André Warnier
fredk2 wrote: Would'nt you think that a (simple) timer for the header could fend off some of the effect. Can't we assume that if it takes more than 3 second to enter the header we do not want that client (i'll have to learn to type faster in telnet :-). For the headers, I think it might

Re: [us...@httpd] Setting the Timeout directive to refrain a DoS attacks

2009-06-25 Thread William A. Rowe, Jr.
André Warnier wrote: fredk2 wrote: Would'nt you think that a (simple) timer for the header could fend off some of the effect. Can't we assume that if it takes more than 3 second to enter the header we do not want that client (i'll have to learn to type faster in telnet :-). For the

Re: [us...@httpd] Setting the Timeout directive to refrain a DoS attacks

2009-06-25 Thread André Warnier
William A. Rowe, Jr. wrote: André Warnier wrote: fredk2 wrote: Would'nt you think that a (simple) timer for the header could fend off some of the effect. Can't we assume that if it takes more than 3 second to enter the header we do not want that client (i'll have to learn to type faster in

[us...@httpd] Wildcard-domain environment var for ProxyHTMLURLMap

2009-06-25 Thread Florian S.
Hi! I got a question about how/where to use environment vars. Assume a simple namebased VirtualHost that is a reverse proxy: Listen 127.0.0.1:1234 NameVirtualHost 127.0.0.1:1234 VirtualHost 127.0.0.1:1234 ServerName *.foo.com ProxyPass /

Re: [us...@httpd] Setting the Timeout directive to refrain a DoS attacks

2009-06-25 Thread Tom Evans
On Thu, 2009-06-25 at 10:17 -0500, William A. Rowe, Jr. wrote: André Warnier wrote: fredk2 wrote: Would'nt you think that a (simple) timer for the header could fend off some of the effect. Can't we assume that if it takes more than 3 second to enter the header we do not want that

Re: [us...@httpd] Re: Weird problem with SSL and Google Chrome and IE7/8.

2009-06-25 Thread Bill Davidson
André Warnier wrote: Did you try commenting that line out ? Hmm. Commenting it out seems to fix it with IE7. Not sure what will happen to IE6 though. Now I have to go find our old Win2k box and see if it will still boot. Doesn't affect Chrome though, which still has the problem. Maybe I

Re: [us...@httpd] Setting the Timeout directive to refrain a DoS attacks

2009-06-25 Thread William A. Rowe, Jr.
Tom Evans wrote: It is a bit like an arms race - I guess a solution could be to use a dedicated thread for reading in POST bodies. This is why IIS appears to the author that is invulnerable; IIS does fill an initial buffer, at least 64k worth. Exhaust that buffer and it should cripple IIS

[us...@httpd] Serving subdomains - ProxyPassMatch issues

2009-06-25 Thread Karthik Manimaran
Hi, We want to serve an unlimited number of subdomains ( http://subdomain1.domain.com http://subdomain2.domain.com) from an app server in the following way: http://localhost:port/somecontext/?param=subdomain1, http://localhost:port/somecontext/?param=subdomain2 resp. Any ideas on how this can be

Re: [us...@httpd] Serving subdomains - ProxyPassMatch issues

2009-06-25 Thread Karthik Manimaran
ProxyPassReverse too doesn't work when I use regex. Thanks, Karthik. On Thu, Jun 25, 2009 at 1:12 PM, André Warnier a...@ice-sa.com wrote: Karthik Manimaran wrote: Hi, We want to serve an unlimited number of subdomains ( http://subdomain1.domain.com http://subdomain2.domain.com) from an

Re: [us...@httpd] Serving subdomains - ProxyPassMatch issues

2009-06-25 Thread André Warnier
Karthik Manimaran wrote: Hi, We want to serve an unlimited number of subdomains ( http://subdomain1.domain.com http://subdomain2.domain.com) from an app server in the following way: http://localhost:port/somecontext/?param=subdomain1, http://localhost:port/somecontext/?param=subdomain2 resp.

Re: [us...@httpd] Re: Weird problem with SSL and Google Chrome and IE7/8.

2009-06-25 Thread André Warnier
Bill Davidson wrote: André Warnier wrote: Did you try commenting that line out ? Hmm. Commenting it out seems to fix it with IE7. Not sure what will happen to IE6 though. Now I have to go find our old Win2k box and see if it will still boot. You could also examine the User-Agent headers

Re: [us...@httpd] Serving subdomains - ProxyPassMatch issues

2009-06-25 Thread André Warnier
Karthik Manimaran wrote: ProxyPassReverse too doesn't work when I use regex. I'm not sure it works either, but have you actually tried using your $1 and $2 in the ProxyPassReverse line ? One never knows.. I'm no great expert here, but I have been re-reading the on-line docs for Proxyx

Re: [us...@httpd] Serving subdomains - ProxyPassMatch issues

2009-06-25 Thread William A. Rowe, Jr.
Karthik Manimaran wrote: ProxyPassReverse too doesn't work when I use regex. Of course it does. You just need multiple ProxyPassReverse mappings to correct the myriad ways that the forward pass had occurred. Setting the back end server to use canonical server name and URI's sure helps.

[us...@httpd] unable to access /proc/pid/fd directory in Apache

2009-06-25 Thread Anuradha
Hi All, In apache I want to  find the list of process which are accessing the file. I am using the lsof command with popen system call.   For each process with pid a directory will be created in /proc. In /proc/pid/fd directory list all the files which are beeing used by the process. But in

Re: [us...@httpd] How can I secure my apache server from DoS attack ?

2009-06-25 Thread Fred K
On Tue, Jun 23, 2009 at 8:30 AM, Damian Myerscoughdamian.myersco...@gmail.com wrote: Hello Neelesh, It is possible to use a modules called: mod_evasive this will help prevent DOS attacks occurring. http://www.zdziarski.com/projects/mod_evasive/ Hi, mod_evasive will not work for this...

Re: [us...@httpd] Apache2 startup error on Solaris 10

2009-06-25 Thread Fred K
On Tue, Jun 16, 2009 at 2:46 AM, Igor Cicimovicici...@gmail.com wrote: Hi all, I have compiled and installed apache2.2.11 with mod_security and SSL on Solaris 10. All was fine until I moved it to jail I had built in /chroot. The error I get is: [Tue Jun 16 16:19:47 2009] [info] Init: