[users@httpd] Default 403 response when no matching vhost

2020-07-13 Thread Danny Mallory
Figure I would ask this here for the most graceful answer before making up my own. When running Apache for many vhosts (websites or acting as a reverse proxy), is there a way to make the default site (no matching vhost) return a 403 or 400 bad request similar to how Akamai does when no matching vh

[users@httpd] AllowEncodedSlashes

2020-06-22 Thread Danny Mallory
With this default parameter Apache returns a 404. Since this seems to be more of a security feature does anyone know a simple way to have it return a 403 instead of a 404? thx in advance Danny

Re: [users@httpd] Apache memory usage

2020-06-19 Thread Danny Mallory
Fri, Jun 19, 2020 at 4:20 PM Yann Ylavic wrote: > > > > On Thu, Jun 18, 2020 at 8:03 PM Danny Mallory wrote: > > > > > > Anyone here know a good way to tell what Apache may be chewing up > memory on? > > > > Do you have MaxMemFree configured al

Re: [users@httpd] Apache memory usage

2020-06-19 Thread Danny Mallory
Jun 18, 2020 at 8:03 PM Danny Mallory wrote: > > > > Anyone here know a good way to tell what Apache may be chewing up memory > on? > > Do you have MaxMemFree configured already > (https://httpd.apache.org/docs/2.4/mod/mpm_common.html#maxmemfree)? > If not, does "M

[users@httpd] Apache memory usage

2020-06-18 Thread Danny Mallory
Anyone here know a good way to tell what Apache may be chewing up memory on? I have Apache running purely as a reverse proxy (not hosting anything), timeouts configured everywhere and good cleanup on threads, scoreboard staying clean, but after a clean restart it will slowly climb and climb throu

[users@httpd] URI query string in a post method

2017-10-17 Thread Danny Mallory
Hello All, I have an application where the client is sending a post method / form to an apache reverse proxy and the request contains a uri query string. Apache is throwing a 400 bad request on this. is there a way to tell apache to ignore a malformed post method? I understand you cannot rewrite

[users@httpd] phishing / spoofing question with 404

2017-06-23 Thread Danny Mallory
My apologies for posting this question if it has already been hashed out before. I figured I should post this question here then just an arbitrary bug report. My question relates to a recent penetration test that reported a content spoofing finding against that the root cause was simply the Apach