Re: [users@httpd] MTLS Setup issue - Apache HTTP Server and Weblogic

2024-04-23 Thread Yann Ylavic
On Mon, Apr 22, 2024 at 3:51 PM Daiya, Devendra singh wrote: > > SSLVerifyCLient require > SSLVerifyDepth 10 These directives apply to the client/browser connection, so you are effectively enabling mtls on the client side too, hence the error messages ("AH02008: SSL library error 1 in handshake

Re: [users@httpd] RewriteMap and patterns

2024-03-29 Thread Yann Ylavic
On Sun, Mar 24, 2024 at 2:31 AM Dave Wreski wrote: > > I'd like to be able to use the static map for the IDs I do know, and send any > others to the redirect script directly from within my apache config directly. > Is this possible? > > Something like this: > > RewriteEngine on > RewriteMap

Re: [users@httpd] working with a reverse proxy

2024-02-28 Thread Yann Ylavic
On Tue, Feb 27, 2024 at 9:49 PM Marc wrote: > > Should I for instance set headers, and in the proxied website should I check > on such headers? (Btw this is php). Or are there other things available like > HTTP_X_FORWARDED_FOR mod_proxy should add the "X-Forwarded-Host" header (i.e.

Re: [users@httpd] graceful-stop closes established connections without response

2024-01-31 Thread Yann Ylavic
On Tue, Jan 30, 2024 at 8:24 PM Sherrard Burton wrote: > > i have confirmed that the patch has been applied, and the behavior still > persists, as confirmed by comparing the counts of [SYN,ACK] and accept() > > ~$ tcpdump -n -r /tmp/tcpdump.pcap | grep -Fc '[S.]'; grep -Fh 'accept4' >

Re: [users@httpd] graceful-stop closes established connections without response

2024-01-30 Thread Yann Ylavic
On Tue, Jan 30, 2024 at 11:54 AM Yann Ylavic wrote: > > On Tue, Jan 30, 2024 at 4:37 AM Sherrard Burton wrote: > > > > i was going to add some debugging lines, but when i took a quick look at > > the patch, i wasn't clear on which sections of the code i should be > &

Re: [users@httpd] graceful-stop closes established connections without response

2024-01-30 Thread Yann Ylavic
On Tue, Jan 30, 2024 at 4:37 AM Sherrard Burton wrote: > > i was going to add some debugging lines, but when i took a quick look at > the patch, i wasn't clear on which sections of the code i should be > guaranteed to hit. can you be so kind as to send an updated patch with > some gratuitous

Re: [users@httpd] graceful-stop closes established connections without response

2024-01-29 Thread Yann Ylavic
On Mon, Jan 29, 2024 at 4:59 PM Sherrard Burton wrote: > > On 1/29/24 10:17 AM, Yann Ylavic wrote: > > On Mon, Jan 29, 2024 at 3:06 PM Eric Covener wrote: > > > > The patch helps in this case because we no longer close the listening > > sockets unconditionally,

Re: [users@httpd] graceful-stop closes established connections without response

2024-01-29 Thread Yann Ylavic
On Mon, Jan 29, 2024 at 4:21 PM Eric Covener wrote: > > > > It seems to me If there is no such LB/VIP that stops new connections > > > from landing on this server, the new option should be avoided. > > > > Correct. > > > > > But if there is such a LB/VIP, the option is not really needed. Is it

Re: [users@httpd] graceful-stop closes established connections without response

2024-01-29 Thread Yann Ylavic
On Mon, Jan 29, 2024 at 3:06 PM Eric Covener wrote: > > > Maybe I wasn't clear enough but this patch makes sense only if there > > is something in place that prevents new connections from arriving at > > the stopping httpd children processes (like a frontend/load-balancer > > or a tcp/bpf

Re: [users@httpd] graceful-stop closes established connections without response

2024-01-29 Thread Yann Ylavic
On Mon, Jan 29, 2024 at 2:23 PM Yann Ylavic wrote: > > On Sun, Jan 28, 2024 at 5:26 AM Sherrard Burton wrote: > > > > On 1/27/24 09:46 PM, Eric Covener wrote: > > > > > > Both worker and event MPMs have a dedicated listener thread per child > >

Re: [users@httpd] graceful-stop closes established connections without response

2024-01-29 Thread Yann Ylavic
On Sun, Jan 28, 2024 at 5:26 AM Sherrard Burton wrote: > > On 1/27/24 09:46 PM, Eric Covener wrote: > > > > Both worker and event MPMs have a dedicated listener thread per child > > process, so it will close those copies of the listening sockets much > > more quickly. > > so that i am clear, are

Re: [users@httpd] Secure websockets and proxying

2024-01-23 Thread Yann Ylavic
On Tue, Jan 23, 2024 at 5:22 PM Yann Ylavic wrote: > > On Tue, Jan 23, 2024 at 11:55 AM Erik Thuning wrote: > > > > I have a tomcat application running that accepts websockets. In front of > > this application I'm running apache as a reverse proxy. SSL is > > confi

Re: [users@httpd] Secure websockets and proxying

2024-01-23 Thread Yann Ylavic
On Tue, Jan 23, 2024 at 11:55 AM Erik Thuning wrote: > > I have a tomcat application running that accepts websockets. In front of > this application I'm running apache as a reverse proxy. SSL is > configured in apache, and my tomcat knows nothing about SSL. > > In the usual web traffic case,

Re: [users@httpd] httpd -t -DDUMP_CONFIG and httpd -t -DDUMP_RUN_CFG not helping prove the value of MaxKeepAliveRequests / KeepAlive

2023-12-11 Thread Yann Ylavic
On Mon, Dec 11, 2023 at 2:10 AM Jason Pyeron wrote: > > I thought I could > > httpd -t -DDUMP_CONFIG | grep -e KeepAlive > httpd -t -DDUMP_RUN_CFG | grep -e KeepAlive > > but to no avail. DUMP_CONFIG comes with mod_info (LoadModule required), but it will only show the directives which are

Re: [users@httpd] Problem set addressttl

2023-12-05 Thread Yann Ylavic
Hi; On Tue, Dec 5, 2023 at 11:13 AM Piotr Redel wrote: > > I have apache version 2.4.54. I wanted to add the addressttl=60 parameter in > the BalancerMember section. The addressttl parameter is a new feature not part by any release yet, it will be in the next one (2.4.59). Your only options

Re: [users@httpd] reverse proxying websocket connections

2023-07-04 Thread Yann Ylavic
On Tue, Jul 4, 2023 at 2:28 AM Helmut K. C. Tessarek wrote: > > The documentation states: > > Proxying both HTTP and websockets at the same time, where the websockets URL's > are not websocket-only or not known in advance can be done by using the > RewriteRule directive to configure the

Re: [users@httpd] Proxy with ssl backend server

2023-05-31 Thread Yann Ylavic
On Wed, May 31, 2023 at 4:39 PM Yann Ylavic wrote: > > On Wed, May 31, 2023 at 2:52 PM Josef Wolf wrote: > > > > On Wed, May 31, 2023 at 10:58:27AM +0200, Yann Ylavic wrote: > > > On Thu, May 25, 2023 at 2:38 PM Josef Wolf wrote: > > > > > > >

Re: [users@httpd] Proxy with ssl backend server

2023-05-31 Thread Yann Ylavic
On Wed, May 31, 2023 at 2:52 PM Josef Wolf wrote: > > On Wed, May 31, 2023 at 10:58:27AM +0200, Yann Ylavic wrote: > > On Thu, May 25, 2023 at 2:38 PM Josef Wolf wrote: > > > > > > I am trying to use apache as a proxy to pass requests

Re: [users@httpd] Proxy with ssl backend server

2023-05-31 Thread Yann Ylavic
On Thu, May 25, 2023 at 2:38 PM Josef Wolf wrote: > > I am trying to use apache as a proxy to pass requests to a https backend like > this: > > > > SSLProxyEngine on > ProxyPass/service/ https://backend.do.main:4434/service > ProxyPassReverse /service/

Re: [users@httpd] Keepalive closing connections prematurely on high load on newer httpd versions

2023-05-22 Thread Yann Ylavic
Hi, On Mon, May 22, 2023 at 12:19 PM Mateusz Kempski wrote: > > Then I added following options > to default config on both servers: > ``` > > ThreadsPerChild 25 > StartServers 3 > ServerLimit 120 > MinSpareThreads 75 > MaxSpareThreads 3000 > MaxRequestWorkers 3000 > MaxConnectionsPerChild 0 >

Re: [users@httpd] Strange behavior with directives ProxyRemote and NoProxy

2023-05-05 Thread Yann Ylavic
Hello, On Fri, May 5, 2023 at 9:22 AM Carsten Klein wrote: > > Important(?) side note: through DNS the server can only resolve > local/intranet names and addresses. The DNS refuses to resolve > external/Internet names and addresses. Unless NoProxy contains only domain names (e.g.

Re: [users@httpd] disable httpd ap_directory_walk() before mpm_itk transfer

2023-03-31 Thread Yann Ylavic
On Fri, Mar 31, 2023 at 2:46 PM Yann Ylavic wrote: > > On Fri, Mar 31, 2023 at 2:27 PM Yann Ylavic wrote: > > > > Hello, > > > > On Fri, Mar 31, 2023 at 8:18 AM Stefan Helmert wrote: > > > > > > in my setup, httpd runs on a speci

Re: [users@httpd] disable httpd ap_directory_walk() before mpm_itk transfer

2023-03-31 Thread Yann Ylavic
On Fri, Mar 31, 2023 at 2:27 PM Yann Ylavic wrote: > > Hello, > > On Fri, Mar 31, 2023 at 8:18 AM Stefan Helmert wrote: > > > > in my setup, httpd runs on a specific uid and delegates transfers to > > mpm_itk with AssignUserIDExpr %{reqenv:MAPPED_USER} dynamic uid.

Re: [users@httpd] disable httpd ap_directory_walk() before mpm_itk transfer

2023-03-31 Thread Yann Ylavic
Hello, On Fri, Mar 31, 2023 at 8:18 AM Stefan Helmert wrote: > > in my setup, httpd runs on a specific uid and delegates transfers to > mpm_itk with AssignUserIDExpr %{reqenv:MAPPED_USER} dynamic uid. > > The problem is: httpd runs ap_directory_walk() with its own uid before > delegating to

Re: [users@httpd] Query about support for OpenSSL 1.1.1

2023-02-16 Thread Yann Ylavic
On Wed, Feb 15, 2023 at 9:44 AM Vivek Naruka (EXT-NSB) wrote: > > There is new version of Openssl i.e. Openssl 3.0 available for which Httpd > provide support in its newly released versions. > > We are using Openssl version 1.1.1 in our project and need to know that if > Httpd will continue its

Re: [users@httpd] cannot run test program while cross compiling

2023-02-14 Thread Yann Ylavic
On Tue, Feb 14, 2023 at 6:56 PM Yann Ylavic wrote: > > On Tue, Feb 14, 2023 at 1:13 PM 유원석 wrote: > > > > Hello > > I was trying to cross-compile apache to no avail > > How can I fix this error below? > > Can you try the attached patch? Possible adding ap_c

Re: [users@httpd] cannot run test program while cross compiling

2023-02-14 Thread Yann Ylavic
On Tue, Feb 14, 2023 at 1:13 PM 유원석 wrote: > > Hello > I was trying to cross-compile apache to no avail > How can I fix this error below? Can you try the attached patch? Regards; Yann. Index: configure.in === --- configure.in

Re: [users@httpd] Apache with OpenSSL 3 compiled for FIPS - SSLFIPS invalid

2022-10-21 Thread Yann Ylavic
On Fri, Oct 21, 2022 at 2:07 AM Joshua Smith wrote: > > With that in mind, I’m confused why Apache still complains about not being > compiled for FIPS. What am I missing? Possibly this change (which was overlooked for httpd-2.4.54 release):

Re: [users@httpd] mod_proxy_http getting double-slashes sporadically

2022-07-19 Thread Yann Ylavic
On Fri, Jul 15, 2022 at 9:35 PM wrote: > > Ok, trying to figure out how to fix this. > > For our mod_proxy configuration we are getting sporadic double-slashes > showing up after the ProxyPass URL. For example: > > ProxyPass /myapp balancer://mybalance/myapp > ProxyPassReverse /myapp

Re: [users@httpd] reverse proxy issue

2022-06-08 Thread Yann Ylavic
On Wed, Jun 8, 2022 at 3:21 PM Serge Krawczenko wrote: > > We have application server behind httpd as a reverse proxy, > with basic ldap auth, so only ldap authenticated users are able to get into > the application. > (Require valid-user > Allow from all > ) It's usually not a good idea

Re: [users@httpd] Re: Apache threads getting killed

2022-05-17 Thread Yann Ylavic
On Tue, May 17, 2022 at 7:02 PM Rajkumar Adsule wrote: > > I am using apache / httpd as a web server i.e. lamp configured on CentOS > system. Apache version 2.4.34 was working fine, it started killing threads > when I upgrade apache to 2.4.53. > > Please help with the possible reasons and

Re: [users@httpd] Variable of document root path based on source ip

2022-05-03 Thread Yann Ylavic
On Tue, May 3, 2022 at 5:44 PM Yann Ylavic wrote: > > On Mon, May 2, 2022 at 8:24 AM Ivan Ionut wrote: > > > > I'm trying to set a virtual host on apache2 with this configuration. > > > > > > ServerName mysite.com > > ServerAlias www.mysite.com >

Re: [users@httpd] Variable of document root path based on source ip

2022-05-03 Thread Yann Ylavic
On Mon, May 2, 2022 at 8:24 AM Ivan Ionut wrote: > > I'm trying to set a virtual host on apache2 with this configuration. > > > ServerName mysite.com > ServerAlias www.mysite.com > > > Define directory_path /srv/http/mysite > > > Define directory_path

Re: [users@httpd] 答复: [users@httpd] [apache]maxconnectionsperchild problem

2022-04-15 Thread Yann Ylavic
On Fri, Apr 15, 2022 at 3:50 PM Yann Ylavic wrote: > > On Fri, Apr 15, 2022 at 2:16 PM 刘孟 wrote: > > > > > > What I want to ask is, will these 1000 sub processes fail at the same time, > > causing my httpd serivce to stop responding.But I think you have give

Re: [users@httpd] 答复: [users@httpd] [apache]maxconnectionsperchild problem

2022-04-15 Thread Yann Ylavic
On Fri, Apr 15, 2022 at 2:16 PM 刘孟 wrote: > > > What I want to ask is, will these 1000 sub processes fail at the same time, > causing my httpd serivce to stop responding.But I think you have given the > answer > >because the clients connections themselves will not have the same > >lifetime

Re: [users@httpd] [apache]maxconnectionsperchild problem

2022-04-15 Thread Yann Ylavic
Hello, On Fri, Apr 15, 2022 at 7:39 AM 刘孟 wrote: > > During the peak hours of the company's internal servers, the number of sub > processes(hpptd) of > each server is about 1000,[Maxconnectionsperchild] is currently set to 0. In > order to be able to > resolve the access target regularlyIn

Re: [users@httpd] Re: Are this option

2022-03-24 Thread Yann Ylavic
On Thu, Mar 24, 2022 at 9:36 AM Marc Serra wrote: > > I tested the settings with Apache Bench ... > > ab -l -H 'Accept-Encoding: gzip,deflate' -k -n 1 -c 1000 > https://www.DOMAIN1.TLD/index.html > > I'm not sure if the following are good numbers or bad numbers. Can > anyone help me interpret

Re: [users@httpd] Re: Are this option

2022-03-18 Thread Yann Ylavic
On Fri, Mar 18, 2022 at 8:27 AM Marc Serra wrote: > > Thank's for your comments Frank, > > Reading the Apache documentation > (https://httpd.apache.org/docs/2.4/en/mod/mpm_common.html#threadlimit) > I cannot find the way to calculate an optimal value for ThreadLimit > and ThreadsPerChild

Re: [users@httpd] configure fails using --with-pcre with httpd-2.4.53

2022-03-14 Thread Yann Ylavic
On Mon, Mar 14, 2022 at 5:46 PM Ash wrote: > > Configure fails for us when building httpd-2.4.53 from source using the > --with-pcre option. The error occurs on both RHEL 8 and Solaris 11.3. A > prior release of httpd (httpd-2.4.51) builds successfully in these same > environments with the

Re: [users@httpd] How to use DH 4096 parameters?

2022-03-14 Thread Yann Ylavic
On Sun, Mar 13, 2022 at 3:55 PM Walter Hop wrote: > > On my old setup, this was DH 2048, which is considered “insufficient” > according to internet.nl. I have tried the following things: > > 1) use a 4096 bit RSA key and get a new certificate > 2) generate DH params with: openssl dhparam -out

Re: [users@httpd] ProxyPass option mapping=servlet hurts mod_rewrite

2022-03-06 Thread Yann Ylavic
Hi Hendrik; > > > RewriteRule "^/alpha/gobeta/(.*)$" http://server2.localnet:8080/beta/$1 > > [P] > If the RewriteRule is specified with the option [P] it works correctly. The > request > https://example.ort/alpha/gobeta/anypath is sent to the beta backend. > > > Also, it seems to me that

Re: [users@httpd] ProxyPass option mapping=servlet hurts mod_rewrite

2022-03-03 Thread Yann Ylavic
On Thu, Mar 3, 2022 at 12:24 PM Yann Ylavic wrote: > > Hi Hendrik; > > > > > after reading your commit comment in https://svn.apache.org/r1898509 I > > realised that one important test case is missing: > > What happens if mod_rewrite manipulates th

Re: [users@httpd] ProxyPass option mapping=servlet hurts mod_rewrite

2022-03-03 Thread Yann Ylavic
Hi Hendrik; > > after reading your commit comment in https://svn.apache.org/r1898509 I > realised that one important test case is missing: > What happens if mod_rewrite manipulates the URL of a target that is proxied > with the option mapping=servlet? > > From my point of view this test case

Re: [users@httpd] ProxyPass option mapping=servlet hurts mod_rewrite

2022-03-01 Thread Yann Ylavic
Hi, > > I have applied your patch to my httpd-2.4.52 and created two test cases. > One with a simple RewriteRule and a second one using a RewriteMap. > Both are working fine. :-) Thanks for testing! Now checked in https://svn.apache.org/r1898509 Regards; Yann.

Re: [users@httpd] ProxyPass option mapping=servlet hurts mod_rewrite

2022-02-28 Thread Yann Ylavic
Hi Hendrik, > > Is this a bug or do I have to use the "mapping=servlet" option very carefully? I'd say both.. mod_proxy mapping= acts very early in request processing and kind of "appropriates" the request URI to mod_proxy, confusing mod_rewrite, so it's probably a bug because your use case is

Re: [users@httpd] adding cloudstack to our internal cloud

2021-11-16 Thread Yann Ylavic
Hi, On Mon, Nov 15, 2021 at 8:27 PM Mohamad Bannout wrote: > > First time user here, > > We have private cloud setup in our company using vmware with only vcenter for > management, I’m considering adding cloudstack to the mix. You probably want to contact the Apache Cloudstack users mailing

Re: [users@httpd] Problem when compiling httpd-2.4.51 on MacOSX

2021-11-16 Thread Yann Ylavic
Hi, On Mon, Nov 15, 2021 at 7:33 PM Israel Timoteo wrote: > > mod_ext_filter.c:372:10: error: implicit declaration of function > 'apr_procattr_limit_set' is invalid in C99 > [-Werror,-Wimplicit-function-declaration] What's the definition of APR_HAVE_STRUCT_RLIMIT in

Re: [users@httpd] Issue with Apache 2.4.51 hanging

2021-10-27 Thread Yann Ylavic
On Tue, Oct 26, 2021 at 7:36 PM Patrick Verdon wrote: > > Do you know who maintains mod_php, is it worth following up with them? I'd suggest reporting the issue to the php maintainers (https://bugs.php.net/). It may ring a bell there.. Regards; Yann.

Re: [users@httpd] Linking a third party library with httpd during installation

2021-10-20 Thread Yann Ylavic
On Wed, Oct 20, 2021 at 10:55 PM Shariful Alam wrote: > > I do not understand why it shows my C compiler is not working? The config.log > https://pastebin.com/U72JMZqF This is because "./configure" will try to run this command to test the compile: gcc -DSSL_EXPERIMENTAL_ENGINE -DSSL_ENGINE

Re: [users@httpd] timeout and keepalive parameter in ProxyPass

2021-10-19 Thread Yann Ylavic
On Wed, Oct 13, 2021 at 4:22 PM Usha Nayak wrote: > > Need help in understanding the highlighted parameters: > > ProxyPass "/example" "http://backend.example.com; timeout=3600 keepalive=On > > keepalive parameter - As I understand relates to TCP or socket keep alive > probes that are sent to

Re: [users@httpd] Issue with Apache 2.4.51 hanging

2021-10-18 Thread Yann Ylavic
Hi Patrick, On Mon, Oct 18, 2021 at 10:13 PM Patrick Verdon wrote: > > Just a quick follow up - we've tried removing mod_http2 but still managed to > provoke a crash. See the error_log below when stopping/restarting after httpd > becomes unresponsive. It seems to have eliminated the

Re: [users@httpd] Issue with Apache 2.4.51 hanging

2021-10-18 Thread Yann Ylavic
Hi Patrick, On Mon, Oct 18, 2021 at 11:27 AM Patrick Verdon wrote: > > # cat /var/log/httpd/error_log > httpd: misc/apr_reslist.c:161: reslist_cleanup: Assertion `rl->ntotal == 0' > failed. [] > *** Error in `/usr/sbin/httpd': corrupted size vs. prev_size: > 0x557f94567e4f *** [] > httpd:

Re: [users@httpd] Httpd is hanging intermittently

2021-09-22 Thread Yann Ylavic
On Wed, Sep 22, 2021 at 8:12 PM alchemist vk wrote: > > I am pretty sure, we not changed anything related to httpd config for quite a > time time and have no idea, why this issue started getting manifested now. Which operating system and openssl version are you using? Did you upgrade openssl

Re: [users@httpd] httpd SIGILL

2021-07-02 Thread Yann Ylavic
On Fri, Jul 2, 2021 at 2:09 PM RONDEC JUNE RUBIO wrote: > > I have not tried to repro the issue with higher version. Is it known issue? Not to me (doesn't ring a bell). But I'm not very inclined to investigate if it's already fixed.. Regards; Yann.

Re: [users@httpd] httpd SIGILL

2021-07-02 Thread Yann Ylavic
Hi, On Fri, Jul 2, 2021 at 8:04 AM RONDEC JUNE RUBIO wrote: > > I've been investigating this issue with httpd corrupted memory and throwing > SIGILL. I can pinpoint what makes the memory corrupted. Is this known issue > guys could someone shed some light. > > callstack : > Core was generated

Re: [users@httpd] Bug in mod_proxy_balancer or just a bad configuration?

2021-06-18 Thread Yann Ylavic
On Fri, Jun 18, 2021 at 10:35 AM Yann Ylavic wrote: > > Hi Daniel, Hi Nick, sorry.. (Hi Daniel too though!) - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mail: u

Re: [users@httpd] Bug in mod_proxy_balancer or just a bad configuration?

2021-06-18 Thread Yann Ylavic
Hi Daniel, How do you monitor this, but looking at the request Cookie header sent by the browser or the Set-Cookie sent by httpd? >> >> >> >> >> >> Header add Set-Cookie "RZROUTEID=.%{BALANCER_WORKER_ROUTE}e; path=/" >> >> env=BALANCER_ROUTE_CHANGED What if you configure "path=/rz" here

Re: [users@httpd] Apache Reverse Proxy SSL to TOMCAT no SSL

2021-06-01 Thread Yann Ylavic
Hi, On Tue, Jun 1, 2021 at 5:24 PM Carlos Castro wrote: > > > [] > ProxyRequests On You probably should remove the above line (which is not in the non-SSL virtual host by the way). Regards; Yann. - To unsubscribe,

Re: [users@httpd] Why so much difference in memory used per process in apache2 between two different systems

2021-05-17 Thread Yann Ylavic
Hi, On Mon, May 17, 2021 at 1:34 PM Marc Serra wrote: > > I have a pair of Ubuntu dedicated servers... > > Server1: > Ubuntu 16.04.7 (64 bits) > 16GB RAM > 8 Xeon CPU > Apache 2.4.18 > MPM mode: prefork > > Server2: > Ubuntu server 20.04.2 (64 bits) > 32GB RAM > 8 Xeon CPU > 2.4.41 > MPM mode:

Re: [users@httpd] mod_proxy_hcheck response timeout?

2021-04-26 Thread Yann Ylavic
Hi Daniel, On Thu, Apr 22, 2021 at 12:21 PM Daniel Ferradal wrote: > > Is my approach correct? As with most initial approaches to a specific > scenario, this may very well be the case, which other approach do you > suggest? I think that it's missing in the code but can't think of a workaround.

Re: [users@httpd] Re: Help: Building httpd from source with specific (different then system default) OpenSSL

2021-04-07 Thread Yann Ylavic
On Wed, Apr 7, 2021 at 10:56 PM Shariful Alam wrote: > > Yes, I'm looking for libssl. But not the default one. Here, you can see that > my mod_ssl.so is still linked with the default libssl. However, during httpd > installation, I use the following configuration, > >

Re: [users@httpd] Help: Building httpd from source with specific (different then system default) OpenSSL

2021-04-07 Thread Yann Ylavic
Hello, On Wed, Apr 7, 2021 at 10:30 AM Shariful Alam wrote: > > root@:/etc/apache2/bin# ldd httpd > linux-vdso.so.1 => (0x7fffe4df9000) > libpcre.so.1 => /usr/local/pcre/lib/libpcre.so.1 (0x7ff2ad391000) > libaprutil-1.so.0 => /usr/local/apr/lib/libaprutil-1.so.0

Re: [users@httpd] Re: External exception in httpd

2021-04-01 Thread Yann Ylavic
On Thu, Apr 1, 2021 at 8:56 AM Michael Rabatscher wrote: > > we always use the precompiled version from > https://www.apachelounge.com/download/ > (httpd-2.4.46-win32-VS16.zip) Hopefully it's fixed in [1], if you could apply this patch and test it would help backporting it to 2.4. If you don't

Re: [users@httpd] Re: External exception in httpd

2021-03-31 Thread Yann Ylavic
On Wed, Mar 31, 2021 at 12:56 PM Christophe JAILLET wrote: > > Le 30/03/2021 à 11:30, Michael Rabatscher a écrit : > > > > system exception (code 0xc008) > > > > which as far as I could research is due to a double CloseHandle call in > > libapr > > > > could be a duplicate of

Re: [users@httpd] Apache 2.4.37 graceful restart causes error “scoreboard is full, not at MaxRequestWorkers.Increase ServerLimit.”

2021-03-31 Thread Yann Ylavic
On Wed, Mar 31, 2021 at 1:49 AM A.J. Gatlin wrote: > > For now, I'm trying to solve the problem by increasing some MPM parameters, > but it's all a bit nebulous, since I'll never be completely sure that the > values are sufficient to prevent another deadlock situation in which the > server

Re: [users@httpd] The number of child processes is less than MinSpareThreads.

2021-03-15 Thread Yann Ylavic
On Mon, Mar 15, 2021 at 7:14 AM motoda.hiron...@fujitsu.com wrote: > > > This is working as designed, the server checks only once per second to > > see if processes need to be started or killed based on the current > > idle threads. > > Is it okay for the number of child processes to fall below

Re: Re: [users@httpd] Set SSLCipherSuite dependent on client IP

2021-02-25 Thread Yann Ylavic
On Thu, Feb 25, 2021 at 1:44 PM Brian Wolfe wrote: > > Are you sure that you have any MD5 ciphers enabled. Wrong thread? Regards; Yann. - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands,

Re: Re: [users@httpd] Set SSLCipherSuite dependent on client IP

2021-02-25 Thread Yann Ylavic
On Wed, Feb 24, 2021 at 6:01 PM Hildegard Meier wrote: > > I thought about something like that as cause, but since the client IP is > known from the very first start of the request, before TLS handshake, I > thought it could be evaluated. Yes but to determine the context from which the takes

Re: [users@httpd] stickysession and BalancerMember route

2021-02-17 Thread Yann Ylavic
On Tue, Feb 16, 2021 at 4:52 PM DICKEY Rob wrote: > > The source code appears to perform basic string comparisons to match the > stickysession token value against the route, but are there character or > length constraints to the route attribute? The route is limited to 64 characters and must

Re: [users@httpd] Self built httpd 2.4.43 problems

2021-02-09 Thread Yann Ylavic
Hi Gabriele, There have been some fixes to the APR library since 1.5.2, notably on the Solaris apr_pollset_poll() implementation, though I can only think of a bug [1] pertaining to MPM event (not MPM worker which you seem to be using). It could be worth upgrading to a more recent APR-1.6.5 or

Re: [users@httpd] RE: Apache authorization using require dbd-group from SQL Server database

2021-02-08 Thread Yann Ylavic
estion. Done here (https://bugs.centos.org/view.php?id=18053) for > anyone that may be interested. > > -Original Message----- > From: Yann Ylavic > Sent: Saturday, February 6, 2021 7:31 AM > To: users@httpd.apache.org > Subject: Re: [users@httpd] RE: Apache authorizat

Re: [users@httpd] RE: Apache authorization using require dbd-group from SQL Server database

2021-02-06 Thread Yann Ylavic
n > Apache 2.4.17 entitled > > *) mod_authz_dbd: Avoid a crash when lacking correct DB access permissions. > PR 57868. [Jose Kahan < jose w3.org>, Yann Ylavic] [] > Unfortunately, my Apache now doesn't have the benefits of RHEL if I go this > route You may want to rea

Re: [users@httpd] How to troubleshoot/fix DAV errors during SVN checkout

2021-01-14 Thread Yann Ylavic
On Thu, Jan 14, 2021 at 2:14 PM Yann Ylavic wrote: > > You could use a "ProxyPass ... ttl=[timeout]" on the proxy with > [timeout] < KeepAliveTimeout on the backend (say the KeepAliveTimeout > on the backend's vhost is 5, try ttl=3 in the proxy's ProxyPass > directive)

Re: [users@httpd] How to troubleshoot/fix DAV errors during SVN checkout

2021-01-14 Thread Yann Ylavic
Hi, On Thu, Jan 14, 2021 at 11:15 AM Bram Mertens wrote: > > Our setup: > Subversion 1.10 on RHEL8 served by httpd 2.4 > Reverse proxy httpd 2.4 on RHEL8 [snip backend errors] > Am I correct to assume that it is the client (or something between the client > and the proxy server) that is

Re: [users@httpd] mod_lua / mod_proxy: set cookie on the proxied connection

2021-01-08 Thread Yann Ylavic
On Fri, Jan 8, 2021 at 10:30 AM Gerry wrote: > > > function proxy_handler(r) > > if r.uri:match("^/local/websocket") then > > r.handler = "proxy-server" > > r.proxyreq = apache2.PROXYREQ_REVERSE > > r.filename =

Re: [users@httpd] APR util slotmem errors.

2020-12-12 Thread Yann Ylavic
Hi, These are more questions for the dev@apr.a.o (or dev@httpd) mailing list, though there are APR developers on this list too ;) > > Quick question how does the apr use the shm segments and why does it have a > slotmem error if we use mod_proxy with several balancer name calls and > multiple

Re: [users@httpd] APR_USE_SHMEM_SHMGET 0-1 option.

2020-12-11 Thread Yann Ylavic
On Fri, Dec 11, 2020 at 5:43 PM Yann Ylavic wrote: > > On Fri, Dec 11, 2020 at 5:10 PM Wendell Hatcher > wrote: > > > > Hi All, quick question. The APR_USE_SHMEM_SHMGET defined option within > > the shm.c file what does it do exactly and can we set the option

Re: [users@httpd] APR_USE_SHMEM_SHMGET 0-1 option.

2020-12-11 Thread Yann Ylavic
On Fri, Dec 11, 2020 at 5:10 PM Wendell Hatcher wrote: > > Hi All, quick question. The APR_USE_SHMEM_SHMGET defined option within the > shm.c file what does it do exactly and can we set the option to 0 or 1? What > would the setting of the option to those values effect? It's defined (in lib

Re: [users@httpd] Re: GET working but POST failing with error 502

2020-12-09 Thread Yann Ylavic
Hi Anton, On Wed, Dec 9, 2020 at 12:00 PM Anton Shepelev wrote: > > > There should be a line like: > > > > ProxyPass ... http://127.0.0.1:3002 ... > > > > or: > > > > > > ... > > ProxyPass http://127.0.0.1:3002 ... > > ... > > > > > > somewhere, and adding

Re: [users@httpd] Changing the 'Range' inside the RequestHeader on the fly

2020-12-08 Thread Yann Ylavic
On Tue, Dec 8, 2020 at 12:18 PM Ran Mozes wrote: > > RequestHeader edit Range bytes=\s bytes= early I'm surprised this one doesn't work though. Could it be that there are multiple spaces, or a space before the '=' sign too? I.e. doesn't: RequestHeader edit* Range ((\s+=)|(=\s+)) = early work

Re: [users@httpd] Changing the 'Range' inside the RequestHeader on the fly

2020-12-08 Thread Yann Ylavic
On Tue, Dec 8, 2020 at 12:18 PM Ran Mozes wrote: > > > http_request.c(440): [client 10.xxx.xxx.xx:x] Range: bytes= > 7168-414976430 > > Looks like this causes to fail serve the request. Which error exactly does the log show ? Regards; Yann.

Re: [users@httpd] Re: GET working but POST failing with error 502

2020-12-07 Thread Yann Ylavic
On Mon, Dec 7, 2020 at 5:55 PM Anton Shepelev wrote: > > All POST requests fail: when I either repeat the same > requiest over and over, or try different requrest. All GET > requests work. This sounds like a crash or something which causes Redmine to close the connection upon receipt of the POST

Re: [users@httpd] slotmem error still occuring after updating to Apache 2.4.43 APR 1.7.0

2020-12-07 Thread Yann Ylavic
On Mon, Dec 7, 2020 at 6:33 PM Wendell Hatcher wrote: > > Yann, quick question would it be ok to have a cronjob running daily maybe at > slow periods that runs a script to delete the sephmore segments using a > script while apache is running? It shouldn't cause issues with the apache > server

Re: [users@httpd] Re: GET working but POST failing with error 502

2020-12-07 Thread Yann Ylavic
On Mon, Dec 7, 2020 at 1:39 PM Anton Shepelev wrote: > > I wrote: > > > The problem is that Redmine's REST API works for reading > > but not for writing, that is the GET command works whereas > > the POST command fails with error 502 > > Even with the most detailed logging, the failed POST >

Re: [users@httpd] slotmem error still occuring after updating to Apache 2.4.43 APR 1.7.0

2020-12-06 Thread Yann Ylavic
what kind of duplicates there may be.. On Sun, Dec 6, 2020 at 8:21 PM Wendell Hatcher wrote: > > Let me gather this information from one of our servers next week. I will > provide a little more background information tomorrow as well. > > On Sat, Dec 5, 2020, 7:08 PM Yann Ylavic wrote:

Re: [users@httpd] slotmem error still occuring after updating to Apache 2.4.43 APR 1.7.0

2020-12-05 Thread Yann Ylavic
On Fri, Dec 4, 2020 at 7:45 PM Wendell Hatcher wrote: > > This has nothing to do with underlying SHM stuff and everything to do with > how multiple balancers, global and outside of virtual hosts, are initialized > and sometimes persisted. This was changed greatly in 2.4.29.You should find >

Re: [users@httpd] Sending client's IP address to local proxied application server.

2020-10-30 Thread Yann Ylavic
On Fri, Oct 30, 2020 at 9:04 PM Mike Diehl wrote: > > Well, I added this to the vhost definition: > > ProxyPreserveHost On > RemoteIPHeader X-Forwarded-For > > Now I'm getting the web server's outside IP address as the value of the > x-forwarded-for header. This is progress, but not quite what

Re: [users@httpd] Apache memory usage

2020-06-19 Thread Yann Ylavic
On Fri, Jun 19, 2020 at 4:20 PM Yann Ylavic wrote: > > On Thu, Jun 18, 2020 at 8:03 PM Danny Mallory wrote: > > > > Anyone here know a good way to tell what Apache may be chewing up memory on? > > Do you have MaxMemFree configured already > (https://httpd.apache.org/d

Re: [users@httpd] Apache memory usage

2020-06-19 Thread Yann Ylavic
On Thu, Jun 18, 2020 at 8:03 PM Danny Mallory wrote: > > Anyone here know a good way to tell what Apache may be chewing up memory on? Do you have MaxMemFree configured already (https://httpd.apache.org/docs/2.4/mod/mpm_common.html#maxmemfree)? If not, does "MaxMemFree 2048" (for instance) help?

Re: [users@httpd] Tomcat 9 doesnt load ECDSA keystore

2020-06-03 Thread Yann Ylavic
Hi Madhan, wrong list, consider asking on us...@tomcat.apache.org instead. Regards; Yann. On Wed, Jun 3, 2020 at 3:07 AM Madhan Raj wrote: > > Hi all, > > this is my connector tag > scheme="https" secure="true" > protocol="org.apache.coyote.http11.Http11NioProtocol" >

Re: [users@httpd] RewriteRules with ajp and secret

2020-05-18 Thread Yann Ylavic
Hi Christian, On Mon, May 18, 2020 at 11:52 AM wrote: > > But there are several context based RewriteRules like this: > > RewriteRule (.*) ajp://IP:PORT$1 [QSA,P,L] > > I haven’t found any solution to get secret parameter passed in RewriteRules. You need a Proxy directive (provided by

Re: [users@httpd] What is a request for dash ("-")?

2020-04-26 Thread Yann Ylavic
Hi, On Sun, Apr 26, 2020 at 3:43 AM Jeffrey Walton wrote: > > What is this request I see in the logs: > > 186.222.62.229 - - [25/Apr/2020:21:35:18 -0400] "-" 408 - > 186.222.62.229 - - [25/Apr/2020:21:35:18 -0400] "-" 408 - If you are using the default LogFormat (i.e. "common"), the "-"

Re: [users@httpd] What search permissions are missing from where?

2020-04-26 Thread Yann Ylavic
On Sun, Apr 26, 2020 at 6:17 AM Jeffrey Walton wrote: > > As far as I can tell, the search permissions are present. Apache has > access to the file: > > # ls -Al /var > ... > drwxr-xr-x. 4 root apache 33 Apr 26 00:00 www > # ls -Al /var/www/ > ... > drwxr-xr-x. 2 root apache 24 Apr 21 11:20

Re: [users@httpd] Only allow reverse proxy traffic with mod_remoteip

2020-04-25 Thread Yann Ylavic
On Sat, Apr 25, 2020 at 1:24 PM baptx wrote: > > @Yann: About your last reply suggesting Require expr "%{REMOTE_ADDR} != > %{CONN_REMOTE_ADDR}": > I want to restrict access on some virtualhosts only because I want to use > some domain names without Cloudflare. > It looks like your previous

Re: [users@httpd] Only allow reverse proxy traffic with mod_remoteip

2020-04-25 Thread Yann Ylavic
On Sat, Apr 25, 2020 at 12:24 AM Yann Ylavic wrote: > > On Sat, Apr 25, 2020 at 12:17 AM Yann Ylavic wrote: > > > > Hi, > > > > On Fri, Apr 24, 2020 at 10:49 PM bapt x wrote: > > > > > > Is there a way to have the same functionality a

Re: [users@httpd] Only allow reverse proxy traffic with mod_remoteip

2020-04-24 Thread Yann Ylavic
On Sat, Apr 25, 2020 at 12:17 AM Yann Ylavic wrote: > > Hi, > > On Fri, Apr 24, 2020 at 10:49 PM bapt x wrote: > > > > Is there a way to have the same functionality as the directive > > DenyAllButCloudflare from mod_cloudflare when using mod_remoteip? > > I

Re: [users@httpd] Only allow reverse proxy traffic with mod_remoteip

2020-04-24 Thread Yann Ylavic
Hi, On Fri, Apr 24, 2020 at 10:49 PM bapt x wrote: > > Is there a way to have the same functionality as the directive > DenyAllButCloudflare from mod_cloudflare when using mod_remoteip? > I would like to block access to users who try to bypass Cloudflare reverse > proxy (e.g. accessing my web

Re: [users@httpd] Access from Internet to web app

2020-04-22 Thread Yann Ylavic
Hi Serge, On Mon, Apr 20, 2020 at 6:43 PM wrote: > > > I need to access to a web app from the local network and from > internet (GLPI) Not sure what "GLPI" internet means. > > The current configuration is : Is that complete configuration? For instance I don't

Re: [users@httpd] RE: LDAP SASL support in Apache configuration

2020-04-22 Thread Yann Ylavic
On Wed, Apr 22, 2020 at 1:11 PM Eric Covener wrote: > > On Wed, Apr 22, 2020 at 3:28 AM Rathore, Rajendra wrote: > > > > Hi Team, > > > > > > > > Can you please provide me any document or module which we can use to > > support LDAP SASL(ADS) with Apache httpd server. > > > > There's a large

Re: [users@httpd] mod_cgi not passing headers for authentication

2020-03-10 Thread Yann Ylavic
On Tue, Mar 10, 2020 at 2:46 AM Roderick wrote: > > Excuse me the question: does httpd obtain REMOTE_USER by parsing > the AUTHORIZATION header? Yes, that's where it's available for basic auth, so mod_auth_basic will do this:

  1   2   3   4   5   >