I'm using amazon linux on an m3.large instance on EC2.
I had these logs before my apache server was shut down:
[Sun Sep 28 18:54:31.679261 2014] [cgi:error] [pid 32422] [client 67.211.230.58:58937]
script not found or unable to stat: /var/www/cgi-bin/wlogin.cgi
[Mon Sep 29 03:32:17.602213 2014] [cgi:error] [pid 13612] [client 173.45.100.18:42591]
attempt to invoke directory as script: /var/www/cgi-bin/
[Mon Sep 29 03:32:19.142561 2014] [cgi:error] [pid 13623] [client 173.45.100.18:43455]
script not found or unable to stat: /var/www/cgi-bin/hi
[Mon Sep 29 15:40:45.599504 2014] [core:error] [pid 17852] [client 80.82.64.145:51226]
AH00126: Invalid URI in request GET HTTP/1.1
[Mon Sep 29 22:53:46.532859 2014] [mpm_prefork:notice] [pid 10800]
AH00169: caught SIGTERM, shutting down
And.. that's it. My httpd service was shut down.
What I'm smelling here is that some people are trying to access the server by executing CGI scripts with GET request which I found to suspect in this line:
script not found or unable to stat: /var/www/cgi-bin/hi
Here what the hell the "hi" supposed to mean unless it's not an exploiting attempt?
Also:
attempt to invoke directory as script: /var/www/cgi-bin/
They all are coming from thge same ip, 173.45.100.18.
Am I under DDoS and other malicious attack, or something arcane going on?
Related
At my Laravel backend, i found that .env file was publicly accessible !
So i fixted it at htaccess like this:
Options -Indexes
<Files .env>
order allow,deny
Deny from all
</Files>
now i'm getting those errors at my log :
/var/log/ispconfig/httpd/mysite.com/error.log
[Sat Jul 24 02:30:02.012555 2021] [access_compat:error] [pid 12573] [client 34.68.38.253:57077] AH01797: client denied by server configuration: /var/www/clients/client0/web1/web/.env
[Sat Jul 24 02:41:45.397639 2021] [access_compat:error] [pid 12573] [client 77.247.127.218:51261] AH01797: client denied by server configuration: /var/www/clients/client0/web1/web/.env
[Sat Jul 24 04:01:06.465017 2021] [access_compat:error] [pid 10206] [client 162.55.61.168:35064] AH01797: client denied by server configuration: /var/www/clients/client0/web1/web/.env
[Sat Jul 24 05:13:38.355428 2021] [access_compat:error] [pid 32043] [client 27.255.90.119:16470] AH01797: client denied by server configuration: /var/www/clients/client0/web1/web/.env
[Sat Jul 24 10:56:19.576281 2021] [access_compat:error] [pid 15892] [client 45.87.61.234:50726] AH01797: client denied by server configuration: /var/www/clients/client0/web1/web/.env
What's the reason ? do i have to worry about ? how to fix it ?
Config: VPS Debian 9, apache 2.4.25, ispconfig, Laravel 5.3.31
Thank you in advance.
It is because by default apache will have this security feature turned on
Require all denied
You can disable that by adding this in the config file of apache:
Require all granted
I tried to update PHP7.3 to PHP7.4 for my XAMPP Apache on Windows 10. Now Apache won't start...
I'm using a self-signed security certificate for development.
The error message I'm getting from Apache is:
10:30:53 AM [Apache] Attempting to start Apache app...
10:30:53 AM [Apache] Status change detected: running
10:30:54 AM [Apache] Status change detected: stopped
10:30:54 AM [Apache] Error: Apache shutdown unexpectedly.
10:30:54 AM [Apache] This may be due to a blocked port, missing dependencies,
10:30:54 AM [Apache] improper privileges, a crash, or a shutdown by another method.
10:30:54 AM [Apache] Press the Logs button to view error logs and check
10:30:54 AM [Apache] the Windows Event Viewer for more clues
10:30:54 AM [Apache] If you need more help, copy and post this
10:30:54 AM [Apache] entire log window on the forums
These are the latest error log entries:
[Thu Jun 18 09:50:08.253500 2020] [ssl:warn] [pid 3120:tid 520] AH01906: www.example.com:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Thu Jun 18 09:50:08.253500 2020] [ssl:warn] [pid 3120:tid 520] AH01909: www.example.com:443:0 server certificate does NOT include an ID which matches the server name
[Thu Jun 18 09:50:08.278953 2020] [mpm_winnt:notice] [pid 3120:tid 520] AH00354: Child: Starting 150 worker threads.
I followed this tutorial:
https://medium.com/oceanize-geeks/how-to-upgrade-lower-version-to-latest-php-version-in-xampp-on-windows-f7be9a70bbb0
download Thread Safe PHP version from http://windows.php.net
unzip, rename folder to PHP
rename php folder in XAMPP (so mine is now php_7.3)
insert new php folder
inside this new php folder, I renamed php.ini.development to php.ini
then I replaced the PHP module lines in my httpd-xamp.conf as follows:
LoadFile "D:/xampp/php/php7ts.dll"
LoadFile "D:/xampp/php/libpq.dll"
LoadModule php7_module "D:/xampp/php/php7apache2_4.dll"
I'm not sure what to do and concerned that I will just mess it up even more... Help is very much appreciated! I really need Apache to work...
EDIT:
Here's today's complete error log:
[Thu Jun 18 09:50:07.558720 2020] [ssl:warn] [pid 17248:tid 512] AH01906: www.example.com:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Thu Jun 18 09:50:07.559723 2020] [ssl:warn] [pid 17248:tid 512] AH01909: www.example.com:443:0 server certificate does NOT include an ID which matches the server name
[Thu Jun 18 09:50:07.611001 2020] [core:warn] [pid 17248:tid 512] AH00098: pid file C:/xampp/apache/logs/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
[Thu Jun 18 09:50:07.613027 2020] [ssl:warn] [pid 17248:tid 512] AH01906: www.example.com:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Thu Jun 18 09:50:07.613027 2020] [ssl:warn] [pid 17248:tid 512] AH01909: www.example.com:443:0 server certificate does NOT include an ID which matches the server name
[Thu Jun 18 09:50:07.648936 2020] [mpm_winnt:notice] [pid 17248:tid 512] AH00455: Apache/2.4.41 (Win64) OpenSSL/1.1.1c PHP/7.3.11 configured -- resuming normal operations
[Thu Jun 18 09:50:07.648936 2020] [mpm_winnt:notice] [pid 17248:tid 512] AH00456: Apache Lounge VC15 Server built: Aug 11 2019 12:20:04
[Thu Jun 18 09:50:07.648936 2020] [core:notice] [pid 17248:tid 512] AH00094: Command line: 'c:\\xampp\\apache\\bin\\httpd.exe -d C:/xampp/apache'
[Thu Jun 18 09:50:07.655110 2020] [mpm_winnt:notice] [pid 17248:tid 512] AH00418: Parent: Created child process 3120
[Thu Jun 18 09:50:08.205628 2020] [ssl:warn] [pid 3120:tid 520] AH01906: www.example.com:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Thu Jun 18 09:50:08.206625 2020] [ssl:warn] [pid 3120:tid 520] AH01909: www.example.com:443:0 server certificate does NOT include an ID which matches the server name
[Thu Jun 18 09:50:08.253500 2020] [ssl:warn] [pid 3120:tid 520] AH01906: www.example.com:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Thu Jun 18 09:50:08.253500 2020] [ssl:warn] [pid 3120:tid 520] AH01909: www.example.com:443:0 server certificate does NOT include an ID which matches the server name
[Thu Jun 18 09:50:08.278953 2020] [mpm_winnt:notice] [pid 3120:tid 520] AH00354: Child: Starting 150 worker threads.
EDIT 2:
The result of running httpd.exe and httpd.exe -t command via the Windows command prompt:
"httpd.exe: Syntax error on line 537 of C:/xampp/apache/conf/httpd.conf: Syntax error on line 17 of C:/xampp/apache/conf/extra/httpd-xampp.conf: Cannot load D:/xampp/php/php7ts.dll into server: The specified module could not be found."
Line 537 in httpd.confis:
# XAMPP settings
Include "conf/extra/httpd-xampp.conf"
Line 17 in http-xampp.conf is:
LoadFile "D:/xampp/php/php7ts.dll"
Further research led me to this question about php7ts.dll: php7ts.dll cannot load into server
So I ran the commands httpd.exe -v and php.exe -v.
The result is that they're both the 64-bit version, I think:
C:\xampp\apache\bin>httpd.exe -v
Server version: Apache/2.4.41 (Win64)
Apache Lounge VC15 Server built: Aug 11 2019 12:20:04
C:\xampp\apache\bin>php.exe -v
PHP 7.4.7 (cli) (built: Jun 9 2020 13:36:15) ( ZTS Visual C++ 2017 x64 )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
Confirm your confirm php7ts.dll file location and use same in apache httpd configuration file.
You can check if the settings of apache are correct:
Open command prompt and navigate to your apache installation bin folder: cd C:/xampp/apache/bin
Then run the following command to see if the syntax is OK:
httpd.exe -t
I am a new guy for Magento. When I click on backend's System>Configuration>Sales>Payment Methods, I got Internal Server Error. I checked error log file, it shows the below error:
[Tue Nov 29 20:25:39.934637 2016] [access_compat:error] [pid 306944:tid 140107193476864] [client 210.5.50.143:55854] AH01797: client denied by server configuration: /var/www/vhosts/baoho.nz/httpdocs/app/etc/local.xml
[Tue Nov 29 20:25:40.318493 2016] [:error] [pid 306946:tid 140107373123328] [client 222.153.188.223] ModSecurity: Output filter: Response body too large (over limit of 524288, total not specified). [hostname "baoho.nz"] [uri "/index.php/admin/system_config/edit/section/payment/key/0ad75a974774456d274ebf7c4bcf4cb1/"] [unique_id "WD0tb#nx70z3ONKpFlNGtgAAAEI"]
[Tue Nov 29 20:25:40.318964 2016] [proxy_fcgi:error] [pid 306946:tid 140107373123328] [client 222.153.188.223:55836] AH01068: Got bogus version 101, referer: http://baoho.nz/index.php/admin/system_config/edit/section/checkout/key/0ad75a974774456d274ebf7c4bcf4cb1/
[Tue Nov 29 20:25:40.318986 2016] [proxy_fcgi:error] [pid 306946:tid 140107373123328] (22)Invalid argument: [client 222.153.188.223:55836] AH01075: Error dispatching request to :, referer: http://baoho.nz/index.php/admin/system_config/edit/section/checkout/key/0ad75a974774456d274ebf7c4bcf4cb1/
I did change .htaccess file's memory limited from 64MB to 512MB. However, it still showed the same error. Could anyone help me to solve this problem?
Thanks
I have been using WAMP on my localhost for a few weeks and since this morning it doesn't work.
This is the error I get when loading localhost: This webpage is not available.
Firefox error is: Unable to connect. Firefox can't establish a connection to the server at localhost.
If I try to load phpmyadmin from the wamp menu, it will return the same error.
This is my apache error log:
[Mon Sep 15 23:10:36.435939 2014] [ssl:warn] [pid 2064:tid 308] AH01873: Init: Session Cache is not configured [hint: SSLSessionCache]
[Mon Sep 15 23:10:36.557946 2014] [mpm_winnt:notice] [pid 2064:tid 308] AH00455: Apache/2.4.9 (Win64) OpenSSL/1.0.1g PHP/5.5.12 configured -- resuming normal operations
[Mon Sep 15 23:10:36.557946 2014] [mpm_winnt:notice] [pid 2064:tid 308] AH00456: Apache Lounge VC11 Server built: Mar 16 2014 12:42:59
[Mon Sep 15 23:10:36.557946 2014] [core:notice] [pid 2064:tid 308] AH00094: Command line: 'c:\\wamp\\bin\\apache\\apache2.4.9\\bin\\httpd.exe -d C:/wamp/bin/apache/apache2.4.9'
[Mon Sep 15 23:10:36.559946 2014] [mpm_winnt:notice] [pid 2064:tid 308] AH00418: Parent: Created child process 4796
[Mon Sep 15 23:10:37.751014 2014] [ssl:warn] [pid 4796:tid 208] AH01873: Init: Session Cache is not configured [hint: SSLSessionCache]
[Mon Sep 15 23:10:37.779016 2014] [mpm_winnt:notice] [pid 4796:tid 208] AH00354: Child: Starting 64 worker threads.
The day before having these problems I followed some instructions on how to make localhost load faster. I got to these instructions by simply googling "localhost slow" but I don't have the exact links to these things.
I do recall though, having disabling IPV6 (which I think is causing some problems now) in the regedit, by adding DisabledComponents with the value fffffff to the registry.
I've already deleted that key.
I also played around with the host file (which I believe I have reverted back to the original).
I currently only have one localhost in it (127.0.0.1). The rest are commented out.
If anyone needs more info, please let me know.
edit: I forgot to mention that when I run google app engine server, my localhost works fine with GAE applications but still doesn't budge for WAMP.
I'm setting up this OSX Mavericks following this guide but I cannot get http://localhost/~giulio to work ('giulio' is this mac username).
Looks like it doesn't find the /users/giulio.conf
This is what's inside the /private/var/log/apache2/error_log
[Thu Feb 27 13:54:41 2014] [notice] caught SIGTERM, shutting down
[Thu Feb 27 13:54:48 2014] [warn] Init: Session Cache is not configured [hint: SSLSessionCache]
httpd: Could not reliably determine the server's fully qualified domain name, using iMac-di-Giulio.local for ServerName
[Thu Feb 27 13:54:48 2014] [notice] Digest: generating secret for digest authentication ...
[Thu Feb 27 13:54:48 2014] [notice] Digest: done
[Thu Feb 27 13:54:48 2014] [notice] Apache/2.2.24 (Unix) DAV/2 PHP/5.4.17 mod_ssl/2.2.24 OpenSSL/0.9.8y configured -- resuming normal operations
[Thu Feb 27 13:54:55 2014] [error] [client ::1] File does not exist: /Library/WebServer/Documents/index-maintenance.html
Solved redoing the whole process and adding Servername Localhost
and adding the follwing code into giulio.conf file into users folder.
<Directory "/Users/giulio/Sites/">
Options FollowSymLinks
AllowOverride None
Order deny,allow
Allow from all
</Directory>