[users@httpd] how is SSLRequireSSL merged?

Hi... (Yes I've read the documentation section about merging sections, but IMHO it's not absolutely clear IMHO) I have one vhost containing about: ... Location / SSLRequireSSL /Location ... and possibly also a later location-section on /, containing other directives, e.g. Location /

[users@httpd] cleanest/fastest way of redirecting aliases to canonical server names

Hi. I'm having a vhost, which is reachable via one canonical name, e.g. example.org, and also via several aliases, e.g. www.example.org, example.com, etc. I want that whenever requests are made via one of the aliases, that those are redirected to the canonical name. IMHO there are about the

[users@httpd] setting options for a single file

Hi. Is it possible to set options (i.e. Allow from all) for a _single_ file while not using Location? I'd like to have a default-deny policy for the whole vhost,... therefore I have something like: Directory /somepath/to/my/vhosts/root Order allow,deny deny from all Direcotry But I'd like to

Re: [users@httpd] setting options for a single file

On Tue, 2011-12-27 at 09:54 -0500, Eric Covener wrote: Probably doesn't make much practical sense, since you can just use directory match in 2.3/2.4 and no change to Files or Directory would likely to ever be available in any older release. Ah... now I've seen what you mean,... it now supports

Re: [users@httpd] setting options for a single file

On Tue, 2011-12-27 at 09:31 -0500, Eric Covener wrote: You could undo it in a subsequent section that only matched longer directory paths. DirectoryMatch is pretty limited in 2.2 and probably not so helpful. Yeah,.. I've thought about this,.. but that also seems a bit hacky... Would it make

Re: [users@httpd] setting options for a single file

On Tue, 2011-12-27 at 03:31 -0500, Eric Covener wrote: nest Files inside of Directory. That shouldn't help should it? When I want to do this for files in the root dir of my vhost (e.g. robots.txt),... I'd have to add the Files in that Directory and it would also apply to all other subdirs of

[users@httpd] some questions on inheritance/section merging

Hi... When I have e.g. Directory /path/toVhostRoot Options none AllowOverride none Satisfy all Order allow,deny Deny from all /Directory and I make a subdir with just: Directory /path/toVhostRoot/subdir Allow from all /Directory 1) Then all of:

[users@httpd] selectively disclaim on SSL client-auth for some directories

Hi. I wondered whether the following is somehow possible (I guess it's not). I have a SSL vhost,... and I'd like to require SSL client cert authentication _per default_ ... but selectively being able to not demand it for some directories/files/locations. Having something like: VirtualHost ..

Re: [users@httpd] setting options for a single file

On Tue, 2011-12-27 at 10:28 -0500, Eric Covener wrote: Is there a different whether I match ^/path/tovHost$ or ^/path/tovHost/$ yes, the note unique to 2.3 is about that. I don't remember where it mattered. Yeah,.. I've read the note in trunk-doc,... but it is unclear (at least to

[users@httpd] CGI/suexec uid/gid per directory possible

Hi. I'd like to run PHP via CGI,... and especially run it as separate user. But it seems that with suexec it's only possible to set a uid/gid für suexec per vhost. I would however like to set this per directory, as I have multiple subdirs, e.g. /davical /forum which all use CGI (or even

[users@httpd] how to limit usage (not location) of (specific) cgi scripts to Direcotries

Hi. Is it somehow possible to limit the _usage_ of cgi-scripts to one Directory or Location. I do not mean the _location_ of the cgi-scripts themselves (which can be limited e.g. via ScriptAlias). Here's the case: I have a vhost, where PHP shall be enabled for a single Directory, but only for

Re: [users@httpd] selectively disclaim on SSL client-auth for some directories [partially SOLVED]

Hey. I guess I've found a solution on my own, well at least a partial one. Here it is for those interested: Don't set the vhost-wide SSLVerifyClient require directly in the VirtualHost block, but either in a Location / SSLVerifyClient require /Location or (if this is enough, as all the

[users@httpd] SSL+SNI+client-auth fakeBasicAuth lost after some time

Hey. This is actually from https://issues.apache.org/bugzilla/show_bug.cgi?id=52703 but it seems bug hunting is not welcomed there anymore, as I've already had to experience in https://issues.apache.org/bugzilla/show_bug.cgi?id=52630 ... So I was redirected here to the list... Well maybe

Re: [users@httpd] SSL+SNI+client-auth fakeBasicAuth lost after some time

is empty. 1st access with success: 02/19/12 03:30:35 129.187.131.227:443 91.8.45.224; /C=DE/O=GermanGrid/OU=LMU/CN=Christoph Anton Mitterer SUCCESS 3 /C=DE/O=GermanGrid/OU=LMU/CN=Christoph Anton Mitterer /C=DE/O=GermanGrid/CN=GridKa-CA 3EC4; GET /icinga/classic/images/interface/menu_blank.gif

Re: [users@httpd] SSL+SNI+client-auth fakeBasicAuth lost after some time

On Sun, 2012-02-19 at 09:04 -0500, Eric Covener wrote: 2nd access: I get an error, that no SNI hostname would have been provided, but still, the ouput appears in the log file of the non-default name based vhost, strange isn't it? No, Apache will still do normal vhost resolution. But how

Re: [users@httpd] SSL+SNI+client-auth fakeBasicAuth lost after some time

=Christoph Anton Mitterer SUCCESS 3 /C=DE/O=GermanGrid/OU=LMU/CN=Christoph Anton Mitterer /C=DE/O=GermanGrid/CN=GridKa-CA 3EC4; GET /icinga/classic/images/interface/menu_less.gif HTTP/1.1 200 200; 506 410 447; lcg-lrz-monitoring.grid.lrz.de https://lcg-lrz-monitoring.grid.lrz.de/icinga/classic

[users@httpd] Apache and BEAST and CRIME attacks

Hi. I'm using Apache 2.2.22 and 2.2.16... and I wondered how vulnerable I'm for the BEAST and CRIME attacks... wrt to BEAST: I know most browsers fix that already,... but I'd rather have it really enforced by the server. Further I would not prefer to disable my AES or enabled RC4 at all. Also

[users@httpd] how to use ProxyPassReverse* with more complex a ProxyPassMatch

Hi. I'm using a reverse proxy set up with ProxyPassMatch as the space I map to is rather complex and can't be mapped with a normal ProxyPass. Now the problem is obviously that: ProxyPassReverse ProxyPassReverseCookieDomain ProxyPassReverseCookiePath are only made for the simply ProxyPass form

Re: [users@httpd] how to use ProxyPassReverse* with more complex a ProxyPassMatch

Hi Brian. On Sun, 2012-12-09 at 07:48 -0600, Brian Millett wrote: Location /helpdesk LimitExcept POST GET PUT Require all denied /LimitExcept DirectoryIndex logon.jsp RewriteEngine On RewriteRule \.(pl|php|cgi) - [QSA,PT,L] RewriteRule

[users@httpd] proxy_html: slowness problems when using ProxyHTMLEnable

Hi. This is about using the external mod_proxy_html (3.1) with Apache 2.2... but I guess it’s largely identical to the one included in Apache 2.4. The setup I have is working, but it’s quite slow (and the machine is extremely powerful, 16 cores, 92 G RAM, fastest disks... 10GbE networking).

Re: [users@httpd] proxy_html: slowness problems when using ProxyHTMLEnable

Hi again. I did some more investigation and found out the following: The slowness is apparently not caused by any INFLATE/DEFLATE combination, cause when I use: #ProxyHTMLEnable off SetOutputFilter INFLATE;proxy-html;DEFLATE ... it's still fast. Actually the slowness seems to come from

Re: [users@httpd] proxy_html: slowness problems when using ProxyHTMLEnable

On Sat, 2012-12-22 at 10:13 -0500, Eric Covener wrote: How slow? Without xml2enc it's about as fast as if I directly access the origin... so say few milliseconds... with xml2enc its (depending on the respective page) from 5-20 seconds. Cheers, Chris. smime.p7s Description: S/MIME

[users@httpd] reverse proxy to http 1.0 origin server

Hi. 1) I'd have a question on how to set up a reverse proxy to a http 1.0 in the cleanest most standard conforming way. AFAIU, strict HTTP 1.0 has neither persistent connections / keep-alives - a connection ends after a single request has been responded. Neither does it have Host: headers. a)

Re: [users@httpd] reverse proxy to http 1.0 origin server

Hi Nick. On Mon, 2013-08-05 at 15:38 +0100, Nick Kew wrote: AFAIU, strict HTTP 1.0 has neither persistent connections / keep-alives - a connection ends after a single request has been responded. Neither does it have Host: headers. No, it has keepalives and Host headers. But the