RE: [users@httpd] CVE-2023-38709: Apache HTTP Server: HTTP response splitting

Is there a severity level for this one? Dream * Excel * Explore * Inspire Jon McAlexander Senior Infrastructure Engineer Asst. Vice President He/His Middleware Product Engineering Enterprise CIO | EAS | Middleware | Infrastructure Solutions 8080 Cobblestone Rd | Urbandale, IA 50322 MAC: F4469

[users@httpd] Re: mod_proxy_wstunnel hijacks subsequent http requests in same tcp connection after websocket handshake error

27;http://localhost:8080/' # BUG? prints both http requests to the nc server, instead of serving files for the first request $ curl -v -H 'Connection: Upgrade' -H 'Upgrade: websocket' 'http://localhost:8080/ws/gateway/notification/notify' --next 'http:/

[users@httpd] mod_proxy_wstunnel hijacks subsequent http requests in same tcp connection after websocket handshake error

to show the problem $ curl 'http://localhost:8080/' $ curl -v -H 'Connection: Upgrade' -H 'Upgrade: websocket' 'http://localhost:8080/ws/gateway/notification/notify' --next 'http://localhost:8080/' ; echo I have tried many things, setting a ttl,

[users@httpd] Apache 2.4 Returns 400 for server names that have a TLD beginning with a number

start with one. Anyone have any insights on this situation? (beyond why a silly person uses such a TLD in the first place :-P) Cheers, Jon

[users@httpd] How to further restrict access to sub directories with ldap-group

os: Red Hat Enterprise Linux Server release 5.3 Thanks in advance Jon B smime.p7s Description: S/MIME Cryptographic Signature

[users@httpd] build issue with old httpd-2.0.55

cp/testing/install/include/apu_want.h' are the same file make[1]: *** [install-include] Error 1 make[1]: Leaving directory `/home/leighton/development/apache/2.0.55/tcp/testing/install' make: *** [install-recursive] Error 1 leighton@chablis:~/development/apache/2.0.55/tcp/testing

Re: [users@httpd] Using mod_ext_filter mode=input

ike you're correct that another request is coming in, but it must be something internal. I'll continue to hack at it. Best Regards, Jon From: Jeff Trawick mailto:traw...@gmail.com>> Reply-To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" mailto:users

Re: [users@httpd] Using mod_ext_filter mode=input

Does anyone still maintain this? Any ideas? Thank you, Jon From: Jon Belanger mailto:jon.belan...@fidelissecurity.com>> Reply-To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" mailto:users@httpd.apache.org>> Date: Thursday, November 8, 2012 5:23 PM

[users@httpd] Using mod_ext_filter mode=input

ave a problem in the cmd script itself, but otherwise isn't much help. Can any provide any examples for this use case? Thank you, Jon Belanger

Re: [users@httpd] using a vendor's apache

hat.com/security/cve/CVE-2011-3607 Hope that helps! -Jon - The official User-To-User support forum of the Apache HTTP Server Project. See http://httpd.apache.org/userslist.html> for more info. To unsubscribe, e-mail: users-u

[users@httpd] mod_rewrite to filesystem path

I've got a per-directory .htaccess file. It lives in /path1. I want to rewrite all requests for *.js to /path2/other.js. I'm getting a 404 error. /path2/other.js is world-readable. So far, in my testing, it seems like I can do it if I put the RewriteRule in the section, but not in the per-direc

[users@httpd] Re: Building apr_dbd_mysql

Jon Drukman cluttered.com> writes: > libtool: link: warning: library `/usr/local/apr/lib/libaprutil-1.la' was > moved. > libtool: link: cannot find the library `/opt/apache/lib/libapr-1.la' or > unhandled argument `/opt/apache/lib/libapr-1.la' > > Any i

[users@httpd] Re: Building apr_dbd_mysql

Nick Kew webthing.com> writes: > Once you've built apr-util as you want it, use the --with options > to httpd configure to select it. You need to point --with to > ap[r|u]-1-config. So I did: ./configure --prefix=/opt/apache --enable-layout=Darwin --enable-mods-shared=all --sysconfdir=/opt/ap

[users@httpd] Re: Building apr_dbd_mysql

Nick Kew webthing.com> writes: > The build messages from configure and make will tell you > whether apr_dbd_mysql.so was built successfully, > and where it was installed. It is built successfully and it is installed into /usr/local/apr/lib. I don't think apache knows to look there however. I

[users@httpd] Building apr_dbd_mysql

What is the trick to get apache to build and install apr_dbd_mysql when compiling from source? I've manually cd'd into srclib/apr-util and manually run ./configure --with-mysql; make; make install but it's not actually putting the DBD driver somewhere where apache can use it. I manually copied t

[users@httpd] Password protect all but one directory

I want to password protect my entire site, except for one URL (which is needed for a load balancer health check). I've done this: AuthType Digest AuthName "password protected" AuthUserFile /srv/passwd.digest Require valid-user Satisfy any Allow from all It doesn't work. Requ

Re: [us...@httpd] LDAP authentication behind proxy?

On 15 Sep 2010, at 02:52, Eric Covener wrote: > You defined your trac wsgi stuff outside of the vhosts and the LDAP > authentication only in one vhost. Yes, I seemed to get a 'WSGIDaemonProcess' syntax error if the trac wsgi stuff was inside the second vhost > I'm guessing the "themeing proxy" i

[us...@httpd] LDAP authentication behind proxy?

In the following, the service on 8002 is a theming proxy, which also proxies the trac service on 8202 (among other things). All public requests come via 8022 (a testing port, that would usually be 80) The problem is, LDAP authentication (fairly obviously) only works when accessing the trac sit

[us...@httpd] Re: Password protect site, but leave one directory open for load balancer

Bram Mertens gmail.com> writes: > Isn't it easier to leave /ping open for all? Remove the entire need > for authentication? I assume it will be a directory with nothing but > a static page for your load balancer to check so nothing that needs to > be protected. I'm fine with leaving /ping open

[us...@httpd] Password protect site, but leave one directory open for load balancer

I'm trying to password protect my entire site, but leave the URI /ping open for the load balancer healthcheck. Here is my configuration: SetEnvIf Request_URI "^/ping" allow_access=1 Order Deny,Allow Deny from all Allow from env=allow_access authuserfile /etc/httpd/conf.d/passwd

[us...@httpd] Combining the best of mod_rewrite and mod_proxy

I have a weird situation that I'm migrating a site that was using WebSphere for a backend to using Resin. We have a requirement that sessions be persistent to the app server, and we've done this thus far by using ProxyPassMatch balancer:// stickysession=JSESSIONID and specifying the route to the b

[us...@httpd] Apache 2.2.9 + haproxy + stunnel + mod_rewrite fun

initial/redir#1] (4) RewriteCond: input='/302.html' pattern='^/cgi-bin(.*)$' => not-matched 165.193.222.20 - - [11/Jan/2010:17:23:56 +] [somewhere.com/sid#4f06840][rid#4f99aa8/initial/redir#1] (1) pass through /302.html I'm at a complete loss as to what I've don

[us...@httpd] Apache redirects

Hi I want to create some method of redirecting phishing sites to the APWG/CUPS anti-phishing page at http://education.apwg.org/r/en/index.htm I know that I can do this on a per folder basis using .htaccess order allow,deny deny from all Redirect 301 / http://education.apwg.org/r/?url/of/phishi

Re: [us...@httpd] how can I compile a module written for apache 2.3 for apache 2.2?

Is there any alternative to .htaccess auth with the ad? On Wed, Jun 17, 2009 at 2:42 PM, Eric Covener wrote: > On Wed, Jun 17, 2009 at 8:41 AM, Eric Covener wrote: >> On Wed, Jun 17, 2009 at 7:39 AM, Jon Skarpeteig >> wrote: >>> http://svn.apache.org/repos/asf/httpd

[us...@httpd] how can I compile a module written for apache 2.3 for apache 2.2?

http://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/aaa/ The module mod_authnz_ldap.c has been updated to support nested groups in AD. I only need that one new directive from this module and I want to compile it, and upgrade the existing apache 2.2 module. How can I do this? --

Re: [us...@httpd] mog_authnz_ldap and AD

How can I accomplish what I'm trying to do? On Wed, Jun 17, 2009 at 11:20 AM, Peter Schober wrote: > * Jon Skarpeteig [2009-06-17 09:56]: >> # Want to add support for nested groups by the following directive >> from http://httpd.apache.org/docs/trunk/mod/mod_authn

[us...@httpd] mog_authnz_ldap and AD

I use the following .htaccess file: # Authentication realm and method: AuthType Basic AuthBasicProvider ldap AuthName "Intranet" # DN of Active Directory server AuthLDAPUrl ldap://asdf:1234/DC=eu?sAMAccountName?sub?(objectClass=*) # An account in the AD that has enough permissions to perform an

[us...@httpd] apache response before chunked request complete

ailable. The only previous discussion I could find on this topic is at (1) My question is whether it is supported in apache (or in the http 1.1 spec) to return a response to a client while the client is still sending the chunked post body of its request. Thanks, Jon ref: (1) http://mail-archives.a

Re: [us...@httpd] Apache 2.2.11 mostly not serving files

Eric Covener wrote: > On Tue, Feb 3, 2009 at 10:56 AM, Jon Foster > wrote: > >> Eric Covener wrote: >> >>> On Mon, Feb 2, 2009 at 9:23 PM, Jon Foster >>> wrote: >>> >>> >>>> [...] I recently >>>> a

Re: [us...@httpd] Apache 2.2.11 mostly not serving files

Eric Covener wrote: > On Mon, Feb 2, 2009 at 9:23 PM, Jon Foster > wrote: > >> [...] I recently >> attempted upgrading to APR 1.3.3, apr-util 1.3.4, Apache 2.2.11 and PHP >> 4.4.9. What happened has left me at a loss as to what to look at to fix >> it! All of

[us...@httpd] Apache 2.2.11 mostly not serving files

size but usually firefox just shows a blank file. Wget returns a "no content" error. Rolling back to Apache 2.0.59 has fixed everything. THX - Jon -- Jon Foster JF Possibilities, Inc. j...@jfpossibilities.com 54

RE: [EMAIL PROTECTED] Solaris build w/LDAP support

e.g. --with-ldap-include=/usr/local/include) -Original Message- From: Jon Wilmoth Sent: Friday, June 20, 2008 4:00 PM To: users@httpd.apache.org Subject: [EMAIL PROTECTED] Solaris build w/LDAP support I'm trying to build 2.2.9 with support for ldap authentication on a solaris 10 box, b

[EMAIL PROTECTED] Solaris build w/LDAP support

know where the openldap install is would be greatly appreciated. Thanks, Jon Wilmoth PKGINST: SMColdap NAME: openldap CATEGORY: application ARCH: sparc VERSION: 2.4.10 BASEDIR: /usr/local VENDOR: The OpenLDAP Group PSTAMP: Steve Christensen INSTDATE: Ju

[EMAIL PROTECTED] Re: proxy & mime type issues

> I am running a site with a front end apache web server load balancing > between multiple backend mod_perl application servers. I am using the > proxy, proxy_balancer, and proxy_http modules to do the load > balancing. The load balancing is working fine, with the major > exception being that it

[EMAIL PROTECTED] proxy & mime type issues

p-02/handler/index.cgi route=http2 ProxySet lbmethod=byrequests SetHandler balancer-manager Order deny,allow Allow from localhost Thanks for the help, - jon - The official User-

Re: [EMAIL PROTECTED] Problem With Password Protection in Apache 2.2

above modules, plus the below directives work: -- AuthType Basic AuthName "Restricted Files" AuthUserFile /users/chemweb/apache2/http-cchem/htdocs/admittedstudent/.htpasswd Require user gsportal AdmittedStudent -- Thanks to everyone, especially Joshua Slive, for

Re: [EMAIL PROTECTED] Problem With Password Protection in Apache 2.2

solve this soon I'm going to go ahead and try .htaccess files but I'd rather do this right by using directives in the httpd.conf file. Thanks for your comments. Jon Forrest Unix Computing Support College of Chemistry 173 Tan Hall University of Californ

[EMAIL PROTECTED] Problem With Password Protection in Apache 2.2

check user. No user file?: /admittedstudent/ What's weird is that I get this message even if I comment out the AuthUserFile directive. The rest of the web site seems to be working fine. What am I doing wrong? Cordially, -- Jon Forrest Unix Computing Support College of Chemistry 173 Tan Hall Uni

Re: [EMAIL PROTECTED] Very Puzzling Question About mod_rewrite (**Solved**)

h the following, which appears to work: RewriteRule ^/(.+?)/(.*)$/$1/public_html/$2 [L] It's critical that the first part of the regular expression use minimal matching. Thanks for everyone's help. Cordially, -- Jon Forrest Unix Computing Support College of Chemist

Re: [EMAIL PROTECTED] Very Puzzling Question About mod_rewrite

Joshua Slive wrote: On Nov 1, 2007 8:45 PM, Jon Forrest <[EMAIL PROTECTED]> wrote: Joshua Slive wrote: Thanks. After doing what you suggest I can see a directory listing of http://www-demo.cchem.berkeley.edu/username/ which shows the index.html file. However, if I click on index.html

Re: [EMAIL PROTECTED] Very Puzzling Question About mod_rewrite

/ (2) prefixed with document_root to /users/chemweb/apache2/http-cchem/htdocs/username/index.html/public_html/ I don't think the rewrite rule I'm using is correct. Cordially, -- Jon Forrest Unix Computing Support College of Chemistry 173 Tan Hall University of California

[EMAIL PROTECTED] Very Puzzling Question About mod_rewrite

hy mod_rewrite tried the other possibilities. I'm guessing all these problem have something to do with directory protection but if this is true then I don't understand why URL #1 works. Any ideas? Cordially, -- Jon Forrest Unix Computing Support College of Chemistry 173 Tan Hall Un

RE: [EMAIL PROTECTED] Geolocation Question

ow Perl modules stack up against C modules in terms of performance?Thanks for replying,Jon> From: [EMAIL PROTECTED]> Date: Mon, 18 Jun 2007 23:34:37 +0200> To: users@httpd.apache.org> Subject: Re: [EMAIL PROTECTED] Geolocation Question> > -BEGIN PGP SIGNED MESSAGE-> H

RE: [EMAIL PROTECTED] Geolocation Question

se to do this was to take advantage of some of the nice features in mod_proxy_balancer (like session management, weighted load balancing, etc...). We are, however, not locked in to this solution. If something more efficient / easier to manage is out there we are definitely open to suggestions.Thank

[EMAIL PROTECTED] Geolocation Question

know of such a patch / mod / plugin / application compatible with apache2? If not, some pointers on where to begin developing this would be greatly appreciated.Thanks,Jon _ Hotmail to go? Get your Hotmail, news, sports and much more! C

[EMAIL PROTECTED] Re: Reverse Proxy - How to disable HTTP access?

Doing this enables the proxy only for the SSL virtual host, which is exactly what I wanted to do!!! Also, it seems that I may use genkey(1) to update the server certificate... Hope this info helps someone else too... Thanks, Jon Brule At 11:04 AM 3/19/2007, Jon Brule wrote: Good Morning

[EMAIL PROTECTED] Reverse Proxy - How to disable HTTP access?

greatly appreciated... Thanks, Jon Brule - The official User-To-User support forum of the Apache HTTP Server Project. See http://httpd.apache.org/userslist.html> for more info. To unsubscribe, e-mail: [EMAIL PROTECTED] "

[EMAIL PROTECTED] Commom Apache configurations shared between live and development servers?

seen as literally the macro name - i.e. $sites_root or as null), is this an Apache limitation? I appreciate any tips or suggestions! Jon. - The official User-To-User support forum of the Apache HTTP Server Project. See

[EMAIL PROTECTED] Re: digest authentication with apache2.2 and mod_authn_dbd

On 1/28/07, Jon Rosebaugh <[EMAIL PROTECTED]> wrote: I'm trying to set up digest authentication with mod_authn_dbd by adapting the basic authentication examples and looking at the reference for mod_auth_digest, and I'm getting the error "No DBD Authn configured!" Everyt

[EMAIL PROTECTED] digest authentication with apache2.2 and mod_authn_dbd

I'm trying to set up digest authentication with mod_authn_dbd by adapting the basic authentication examples and looking at the reference for mod_auth_digest, and I'm getting the error "No DBD Authn configured!" Everything appears fine when the server starts, but when I hit the protected directory,

Re: [EMAIL PROTECTED] configure apr

Bobby, The apr is included with the apache distro. To use it include the configure option --with-included-apr and you should be ok - read the CHANGES file. e.g. cd httpd-2.2.3 ./configure --with-included-apr Regards, Jon On Thursday 14 September 2006 08:47, Bobby Gontarski wrote: > I

Re: [EMAIL PROTECTED] Logging Response time in access log

%D http://httpd.apache.org/docs/2.2/mod/mod_log_config.html#formats Regards, Jon On Friday 08 September 2006 05:21, [EMAIL PROTECTED] wrote: > Hi, > > Is there a way to log the time taken to process a request in milliseconds > precision ? The documentation for %T says it can o

Re: [EMAIL PROTECTED] Re: Apache and router-follow up

proxypassreverse mapping (for an rproxy) in the configuration. Regards, Jon Snow On Sunday 03 September 2006 21:20, John Tunstall wrote: > Hi. I just realised that I should have mentioned that this is all on > Windows XP. > > JohnT > - Original Message - > From: John Tuns

[EMAIL PROTECTED] ProxyPassReverse Apache 2.2.2 and Sybase EAServer

, the request at the browser shows up as http://localhost:8080/somebrokenfile   The files that don't load are varied: .gif, .js, .jsp   Has anyone encountered anything like this?   Thanks!   -Jon

[EMAIL PROTECTED] Apache 2.2: No groups file?

I'm trying to use a (rather old) module called mod_auth_mda to do cookie authentication. The new Apache 2.2 authentication stuff is confusing me though. Relevant config file lines: LoadModule authz_host_module modules/mod_authz_host.so LoadModule auth_basic_module modules/mod_auth_basic.so Lo

Re: [EMAIL PROTECTED] make error while installing apache 2.0.55 on Solaris 2.8 sparc

as well. Regards, Jon On Tuesday 09 May 2006 16:39, Krishna Mondal wrote: > Hi, > > I am trying to install apache2.0.55 on Solaris8 sparc machine. > > These are the steps i followed. > > 1. FTPed the httpd-2.0.55-sparc-sun-solaris2.8.tar.gz at > /export/home/netiq/apach

Re: [EMAIL PROTECTED] Reverse DNS lookup issue - No access from WAN, but LAN works fine

then you should believe it. Regards, Jon On Sunday 02 April 2006 23:43, Vincent Lextrait wrote: > Hi all, > I am running Apache 2.0.55 for win32, without add-ons, on Windows XP > Professional SP2, with firewall and anti spyware all deactivated. The conf > file is very plain. >

Re: [EMAIL PROTECTED] Can apache and ssh share port 80?

modifications through that? If they want you to make real time modifications while you are there they need to provide you with the resources. Regards, Jon On Saturday 01 April 2006 08:09, [EMAIL PROTECTED] wrote: > Hi all -- > > I have a linux box running several websites usi

[EMAIL PROTECTED] Re: mod_rewrite doesn't always prefix with document_root

Jon Drukman wrote: is there a way to substitute the documentroot variable instead of hardcoding it? we have the same rewrite file used by many many virtualhosts, and being able to refer to just /misc/whatever and have it automatically map to the correct docroot would be extremely valuable

[EMAIL PROTECTED] Re: mod_rewrite doesn't always prefix with document_root

Robert Ionescu wrote: Jon Drukman wrote: Notice how in the good case it's doing "prefixed with document_root to..." Why would it skip that in the first case? Is it because I have a /misc directory on my filesystem? Exactly, that's normal behavior in per-server contex

[EMAIL PROTECTED] Re: mod_rewrite doesn't always prefix with document_root

Joshua Slive wrote: On 3/17/06, Jon Drukman <[EMAIL PROTECTED]> wrote: I've got the following rule in my config: rewriterule ^/e3/(.*) /misc/e3/$1 [L] It doesn't work. If I change the "/misc" to "/test", it does. Do you happen to have a /misc/e3 direct

[EMAIL PROTECTED] mod_rewrite doesn't always prefix with document_root

I've got the following rule in my config: rewriterule ^/e3/(.*) /misc/e3/$1 [L] It doesn't work. If I change the "/misc" to "/test", it does. Here's what's in the rewrite log for the bad case: (edited for brevity) (2) init rewrite engine with requested uri /e3/index.html (3) applying pattern

RE: [EMAIL PROTECTED] Which directory

o the documentroot. Now can you tell me what I need to do to give permission per the message below? Forbidden You don't have permission to access / on this server. Apache/2.0.55 (Win32) Server at belewconsulting.com Port 80 Bill -Original Message- From: Gallagher, Jon [mailto:[EMAIL

RE: [EMAIL PROTECTED] Which directory

Most webservers have a document root. This is described in detail and can be configured in the httpd.conf file. However - out of the box, the document root for apache httpd is: apache_installation_dir/htdocs Where apache_installation_dir is where you installed apache. In there you will

[EMAIL PROTECTED] Logging Source Ports

to the outbound connection? Regards, Jon - The official User-To-User support forum of the Apache HTTP Server Project. See http://httpd.apache.org/userslist.html> for more info. To unsubscribe, e-mail: [EMAIL PROTEC

Re: [EMAIL PROTECTED] How to fight a client causing DoS ?

/bandwidth/intro-en.html Regards, Jon On Sunday 14 August 2005 09:19, Sean Conner wrote: > It was thus said that the Great Maxim Vexler once stated: > > > > What can be done to stop the "attack" ? > > > > > > It's pretty easy to stop this under Linux (thi

Re: [EMAIL PROTECTED] Why does Apache use up all my memory?

there are similarities in network states or hardware etc. to what I have. Regards, Jon On Wednesday 10 August 2005 01:05, George Adams wrote: > I read an earlier thread on memory consumption (http://tinyurl.com/bly4d), > which may be related to my problem... but because of some differences, I

[EMAIL PROTECTED] proxy_ftp base href breaks authorization

er always sends the user:password in the URL. This then simulates squid behaviour. Does anyone have any idea why/whether the BASE HREF is required in the proxy_ftp html code returned to the client? Thanks, Jon - The offici

Re: [EMAIL PROTECTED] Why does each Apache child process consume 5 MB of RAM?

You might also want to look at how many modules you are loading into the process and remove the ones you do not require. On Thursday 28 July 2005 00:00, dtufs wrote: > Hello, > We are running Apache 1.3.33, PHP 4.3 and MySQL 4.1 > and noticed that each Apache child process takes 5 MB > of RAM as

Re: [EMAIL PROTECTED] Why does each Apache child process consume 5 MB of RAM?

dtufs, You haven't specified any details about your OS or config. I assume *NIX and MPM prefork - have you stripped the binary? Jon On Thursday 28 July 2005 00:00, dtufs wrote: > Hello, > We are running Apache 1.3.33, PHP 4.3 and MySQL 4.1 > and noticed that each Apache child p