Ask MetaFilter questions tagged with web and apache

Theming multiple web applications

larsks — Wed, 05 Nov 2008 11:34:43 -0800

At my office we're running a number of different third-party web applications for things like blogs, ticket tracking, cms, and so forth. I would like to apply some consistent themes to these applications without having learn n different theming mechanisms. I'm hoping y'all can provide me with some suggestions. I'm familiar with deliverance, which so far seems like the best solution, although it seems to have wandered away from xpath queries, which made a lot of sense, into the mists of yet-another-*ml-query-language.

Are there any other solutions out there?

Can I combine htaccess and session variables from other systems?

jpoulos — Wed, 23 Jul 2008 10:03:34 -0800

Web server question. Can I combine htaccess and session variables from other systems? (more inside) OK, bear with me here--I'm a page developer, not a server admin. I've got an apache system that uses htaccess and a .db file to grant access to particular directories. I've also got a set of users who aren't in the .db file, but will be logging in to another system (salesforce.com) and trying to access those restricted areas. Is there a way to allow the first set of users to continue logging in as always, but to allow a session variable that is established on the salesforce.com site to be passed, allowing this second set of users to access the area without having to log in again?

Please Stop Doing That

rokusan — Thu, 12 Jun 2008 08:12:45 -0800

Apache Filter: blocking logins after failed attempts. A coworker asked me this one first, but I'm stumped, so I turn to the hive mind.

He's running a pretty vanilla Apache on FreeBSD to serve a website that has a /members section protected by htaccess. He administers passwords and such fine, and he's happy with the security and reliability and such, but he's starting to have a problem with scripts/robots hammering his login pages with web-based brute force attacks, trying user names (aaron, adam, arthur, axel...) and common passwords.

This isn't a huge security problem but it's proving to be a heck of a drag on his web server, and it's poisoning his traffic data. Apparently "something like 90 percent" of his traffic last weekend was just that kind of noise. I first suggested just blocking the offending IPs within the .htaccess itself, but the source IPs change every couple of hours, and some are from identifiably dynamic IPs like ADSL users, so temporary blocks are definitely the right way, here.

Obviously, he'd rather not reengineer a whole new authentication scheme, and that's probably beyond his ken anyway. So is there an Apache module or middleware script he could use as an add-on or (pre?)login, to provide temporary lockouts for given user names or IP numbers? The goal is something like the typical bank login response: "Too many failed logins, please try again in (1 hour)." where that (hour) is configurable.

Captchas on login might work, but that strikes me as too strange and cruel, I think, to impose on every login.

It's a straight HTML website right now, nothing fancy at all (he uploads members documents by FTP and uses some web-front end CGI from his ISP for adding/removing htaccess users) and he's not comfortable with Perl or PHP beyond install-and-forget. That said, I could probably lend a couple hours of my own help to implement something one-time, as long as it "just works" after that.

Suggestions, geek-hive?

Apache2, mod_php, suexec security confusion.

odinsdream — Tue, 10 Jun 2008 06:58:46 -0800

Apache2 security theory; mod_php versus CGI php and the use of suExec: What is the non-theoretical problem with running Apache2 with mod_php and thus without using suexec on a dedicated system? I'm setting up a typical LAMP environment. I've used phpsecinfo to evaluate my current environment and implemented all of the recommended changes except for two, Group ID and User ID.

The distribution is the most recent Ubuntu Server with the mostly-default Apache2 configuration, and the mostly-default PHP installation, with the exception of the changes recommended by phpsecinfo.

These warnings indicate that my group and user ID numbers are below 100 (33 to be specific), and therefore may be a problem. I am not sure how to interpret this.

I followed the documentation links and was about to implement SuExec when I realized that this meant doing a lot of other reconfiguration, like not using mod_php, and that meant changing a lot of other things, etc.

This is not a shared system. It will only be used to host one company's applications through several virtual hosts. The applications will be PHP-based, and most frequently will use the Symfony framework. Apache currently runs as www-data, whose shell is /bin/false. SSH access to the system is by public-key authentication only and is further restricted at the daemon level to only specific real users.

What do I need to do to run this securely? Resources, guides and real-world examples would be greatly appreciated.

getting .htaccess to do httpd.conf's job

holgate — Mon, 02 Jun 2008 03:37:58 -0800

Mod_rewrite and subdirectories and subdomains, oh my! I'm using a hosting service (Lunarpages) that maps the document root of subdomains to a corresponding subdirectory in the primary domain root (i.e. the public_html directory). Thus: sub1.mysite com has mysite.com/sub1/ as its / directory.

I've also got sub2.mysite.com, which has its document root automatically and unalterably set to mysite.com/sub2/. I would like URLs to sub2.mysite.com to be rewritten so that they go to sub1.mysite.com. A standard external redirect isn't going to work in this case, because the code in /foo/ needs to parse the incoming subdomain.

Got .htaccess, anyone?

(This is, of course, something that would take 0.3s to solve if I could get at the bloody httpd.conf.)

Sending E-mails with PHP

kaozity — Tue, 07 Aug 2007 06:57:35 -0800

How do I get PHP to send an e-mail. Is there a way to do it without recompiling PHP/Apache. If not, how do I recompile PHP/Apache on a linux system to do this? How do I get PHP to send an e-mail. Is there a way to do it without recompiling PHP/Apache. If not, how do I recompile PHP/Apache on a linux system to do this?

Ideally, I would like to find a way without recompiling my software, but if there is not other way, I can recompile the software.

Other frameworks akin to Ruby on Rails?

killdevil — Fri, 06 Jul 2007 16:14:49 -0800

What are the best database-driven Web application development frameworks out there right now? More specifically, please orient me to toolsets you know of that are similar to Ruby on Rails. I have a couple of database-oriented Web applications I'll be working on in the near future. I'd love to avoid (re)writing lots of the low-level code (recordset handling, security, user input validation, &c, &c, &c ) that every such application needs in order to function, as I've done numerous times in the past. Rather than dust off some of my own home-rolled libraries, I'd rather take the time to choose and learn one of the integrated open-source frameworks that have come into being over the past few years.

I know of Ruby on Rails, obviously, and have heard of a a couple of python-based frameworks that seem philosophically similar to RoR. Please note that I'm totally language-agnostic -- I'm quite handy with all the languages that form the "P" in "LAMP" and with some others as well, but I don't mind picking up some new syntax if it'll simplify my development task in the end.

Help me understand my options!

Mod_Rewrite Help Wanted, Apply Within

rokusan — Fri, 02 Mar 2007 09:27:54 -0800

I am in mod_rewrite hell. What a syntax! Can someone smarter than me have a look and tell me I'm not crazy? Thanks! Okay, mod_rewrite is working and respecting my .htaccess file, so there's no installation problem. I wish to shorten URLs in this form:

www.mysite.com/dynamicpages/newstory.shtml?shownews.tmpt&showstory=122

To something like this:

www.mysite.com/news?122

So that users can type the latter and get the same results they would get from the "expanded" first version.

I know this is exactly what mod_rewrite is for, but for the life of me I can't get it to produce anything other than nasty looping errors like "Too many redirects."

Can someone demonstrate the no-doubt three-liner I need? Thanks.

Redirecting with htaccess

fightorflight — Wed, 03 Jan 2007 09:33:14 -0800

Taking a site offline with .htaccess. I have a server which is running in production, but I want to take it offline for some maintenance. While I want everyone who calls at any URL to be redirected to index.html, I want admins to be able to view the site in full. I think something like this in .htaccess:
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !xxx.xxx.xxx.xxx
RewriteRule [regexp to rewrite anything.php to index.html]

where xxx.xxx.xxx.xxx is a permitted IP address should work, but it seems not to. Any help? Even if the solution only allows access from localhost (I can run lynx on the server) it'll do fine.

What's the most robust bandwidth throttling method for my Apache web server?

tweebiscuit — Tue, 31 Jan 2006 10:46:10 -0800

What's the best bandwidth throttling method for my Apache webserver? I run a website that serves a great deal of videos -- we host 50+ videos at around 10-40MB a pop, and receive a few thousand hits a day. We are in no danger of reaching our monthly bandwidth limit. The problem is our concurrent bandwidth limit -- if we average over 10Mbps for too long, we get a nastygram from our ISP. The site is run on a dedicated Apache / Linux server with cPanel and the like.

Before I continue, a proviso: I'm new to all of this. I know my way around a command-line, and can follow tutorials, but I have never tried configuring Apache by hand, normally leaving it up to the cPanel/WHM interface (a web app that can handle most common server config tasks through its GUI). So a) I might get some terms wrong, and b) the more information in your answers, the better -- "Just set up a Widget in your .gadgets file" isn't going to help me much -- full paths or links to tutorials will. Thanks.

Anyway, the story -- when we got the server, I enlisted an internet acquaintence (since incommunicado, and thus unavailable for futher help) to set it up for us. He tried Apache's "modbandwith" (I believe is the name) first, but that established too hard of a limit on our bandwidth output -- out of ten users, the first one or two would get all the bandwidth, and the rest would get nothing, and no bursting was possible. We needed a fuzzier solution, in which the average rate would be lowered if there was too much usage, but still allowed bursting. The acquaintence whipped up a solution by which all references to .mov or .mp4 files are redirected (via an .htaccess file) to another web server, THTTPD, which resides on a different port. THTTPD is a "tiny, throttling" web server, and its throttling has served us pretty well so far, but lately it's been struggling a bit. Add to that the fact that top shows THTTPD using 70% of our memory and that it's not under active development, and I need a different solution.

So the question is: Is there a means to get Apache to do the sort of bandwidth throttling I need? That is, to have it monitor the average bitrate out and reduce it, rather than establishing a hard limit? I would prefer the solution to be Apache based, so I don't need to manage yet another process-I-have-a-hazy-understanding-of on my server, but I want the most robust solution available, and if that means not doing it through Apache, I'm open to it.

Again, I'm not a system administrator or Linux power-user -- compiling is beyond me, and I don't know beans about configuring Apache, so concrete responses like "type this at the command line" or links to packages I should install would be most helpful. Thanks so much!

Refresh vs. Form Re-submission

purephase — Fri, 16 Sep 2005 10:54:09 -0800

Form re-submission woes! How can I catch page refreshes and prevent form values from being re-submitted? I've read a lot on the subject and tried varying tactics to counteract the problem. From hidden form variables and plain old user education, no methodology has worked quite as well as I had anticipated upon implementation. However, a lot of sites seem fairly successful in protecting against this problem so there must be something I'm missing (well, more than one something).

What am I missing? Does anyone have any tried-and-true methods that they've used? If so, are their any caveats to your preferred method?

(This is particularly for Perl/PHP with Apache and/or IIS. I'm hoping for one solution that can be modularized for varying projects, but anything is appreciated.)

Separating vhosts in combined apache logfile?

joshwa — Wed, 17 Aug 2005 17:17:14 -0800

I am in a shared hosting environment, but I host multiple domains using mod_rewrite. Of course, this means all the domains get lumped together in one logfile. I need to be able to separate the individual domains for log analysis, without using a CustomLog statement. Let's take care of the obvious: I can't afford individual accounts for each domain, or upgrading to a dedicated server. I don't have access to httpd.conf, so I can't use with accompanying CustomLog statements.

It would seem that one would be able to infer which request is for which domain by looking at requests in aggregate (e.g. first request is for "/" with the referring page as the referrer, and the second request is for the page's style sheet, graphics, etc, with the requested domain's docroot as the referrer. )

I suppose some perl is the answer, but that's a frightening prospect for me. There's got to be a way to either tag or otherwise indicate in the log entry which domain is being requested, somewhere in .htaccess (where the mod_rewrite rules live, and which is the only apache config to which I have access).

Possible ideas: Can RewriteLog be hacked to do this? Or I could do an AddHandler to a shell script that created the appropriate logs, but that would create serious performance issues.

Or perhaps there's a way to do this in Sawmill, my logfile analyser.

I can't be the only one in this situation, but Google has yielded zilch.

"You'll gonna need a more sophisticated solution."

handybitesize — Thu, 21 Jul 2005 10:35:37 -0800

I've just learnt (after an afternoon of struggling) that Apache's mod_write module doesn't work for embedded media, like a video in object tags. The best response I could get to my problem was "You'll gonna need a more sophisticated solution.". Well thanks. Any pointers? I'm trying to prevent hotlinking (for sensitivity reasons rather than bandwidth) a series of wmv's on a remote http server.

I can protect them nicely if I'm happy to just link to them but if I want to embed them nothing happens. I know I could put embed them in a html file on the remote and protect that html file, but that's not the solution I'm looking for.

Perl, CGI, and Apache

IshmaelGraves — Tue, 15 Mar 2005 21:56:58 -0800

I have a Perl script which is supposed to handle user registration. It works fine from the command line (perl blah.pl "username=blah&password=blah") but doesn't modify the file it's supposed to modify when run as a CGI script in Apache 2.0. I'm assuming this is some sort of permissions issue, but I've done chmod a+w and chmod 777 on the file in question and still no luck. Is there something I need in my httpd.conf?

Apologies if this is a really inane question, but my brain is fried right now and the Apache docs might as well be Greek.

(Also: I know I shouldn't keep my user data in a file. Eventually I will switch to some sort of SQL database. For the moment, though, I'd like to get the authentication crap out of the way so I can work on the fun bits of my webapp.)

Database-driven web sites using using Linux, Apache, MySQL, PHP, etc?

Mwongozi — Fri, 10 Dec 2004 17:25:57 -0800

I know how to make database-driven web sites using Windows servers, Access, IIS, and ASP.

I want to learn how to do the same using Linux, Apache, MySQL, PHP, and... whatever you use instead of Access.

Where do I start?

Looking for good, cheap hosting

grabbingsand — Fri, 01 Oct 2004 10:18:58 -0800

Since web hosting companies tend to come and go like ships on the tide, I would like ">to revisit this question ... with a few alterations. I want the price to stay below $10 a month, possibly even under $5. Instead of 20mb of space, I want 500mb or more. Also, I want PHP, MySql, CGI scripting, FTP, webmail, etc ... and if their servers run on Apache, then all the better. Any recommendations?

Managing JAlbum

blueshammer — Sun, 05 Sep 2004 08:54:22 -0800

I know, I know -- not another web photogallery AskMe question, but: I've actually settled on the gallery itself. I'm using JAlbum. Having made the choice, though, I'm left with two questions:

1. JAlbum makes nice galleries, but doesn't create a top-level index page. (I could hand-code it, but my wife will be doing most of the updating and I don't want her to have to go mucking around in HTML.) The easiest solution, I'd think, would be just to reformat the directory listing into something attractive -- all I really need to communicate to the user is descriptive folder names and upload dates, but I'd prefer to make something more handsome than the standard Apache page. Can anyone recommend a particular PHP file system manager or other solution?

2. JAlbum's auto upload is ridiculously slow -- better just to FTP it. When JAblum makes a gallery, though, it includes a lot of stuff I'm not using -- icon sets, borders, etc. It's not a ton of space, but I'm going to uploading a lot of these galleries, and it'll add up. Is there a programmatic way I can stop JAlbum from including all this, instead of weeding it out before each upload? (I'm using the BluPlusPlus skin.)

What's your favorite WAMP installer and why?

signal — Mon, 19 Jul 2004 12:41:24 -0800

What's your favorite WAMP installer? (and, of course ,why?)

Problem with Apache (Win2K) on a local network

yerfatma — Mon, 09 Feb 2004 14:24:14 -0800

Problem with Apache (Win2K) on a local network . . . I have an install of Apache that runs fine on my Windows 2000 machine. I've added an XP laptop and I want to keep the 2000 machine as my server but work from the XP machine. Trying to browse to the root IP of the 2000 machine gets me an Apache 403 error.

For convenience, I've set up a virtual domain called "tpc-dev", pointed it at the Web Root folder and made an entry on both machines' hosts files. This has gotten me no further, but at least provided a place to put an Allow From All, Allow From 192.168 -type statement which did me no good. But looks professional.

I'm working entirely in the httpd.conf file; there's nothing in .htaccess. Could this be a network user permissions issue? It doesn't seem like a router issue (D-Link wireless router + access point) since I can see Apache.

Is it difficult to change to LAMP/Java from ASP/.NET? Is the open source thing really sticking?

grefo — Fri, 09 Jan 2004 07:40:13 -0800

I have been looking at changing my web development focus from Windows/ASP/.NET to LAMP(Linux, Apache, MySQL, PHP/Python/Perl) because my gut is telling me that this is where things are going. Oh, Java should be in there as well.

What's the skinny on LAMP in the real world (Netcraft surveys aside)? Is it difficult to change to LAMP/Java? Is the open source thing really sticking?