gmane.comp.apache.user

RE: Disk Cache with multiple virtual hosts

Igor Cicimov — 2013-06-19T20:57:21

swap out to disk for whatever is least popular?
No but how much cache do you need? On the heavy load prod servers we were
using 1GB mem cache. Most of the caching is done on the client side anyway.
pages, but am unsure whether I need a unique CacheRoot for each virtual
host, or whether multiple virtual hosts can/should share the same CacheRoot?
(effectively a ramdisk that will page out to swap space if theres not
enough ram to cache everything).
cache in memory?
there anyway to configure Apache to create the CacheRoot directory if it
doesn't already exist? If anyone has any thoughts / recommendations / tips
in this regards to this approach I would be grateful to here them.

combining mod_auth_kerb with mod_proxy

David Mansfield — 2013-06-19T16:01:23

Hi All:

I have a question about whether mod_proxy can do Negotiate 
authentication to a remote site using the credentials "saved" via:

KrbSaveCredentials on

directive in mod_auth_kerb.  I'm not looking to pass-through any 
Authorization header supplied by the client.

Specifically, the user authentication to the first server should NOT be 
via Negotiate, but via a "basic" user/password validated by 
mod_auth_kerb via KrbMethodK5Passwd password based authentication in 
mod_auth_kerb.

user -> server1 : authenticate using user/password , save credentials in 
KRB5CCNAME ticket cache
server1 -> server2: authenticate using Negotiate / GSSAPI using saved 
credentials

Is this possible?

Secondly, when using KrbMethodK5Passwd and KrbSaveCredentials, is it 
possible to cache the ticket cache? Or does it do a kinit every time?

RE: Disk Cache with multiple virtual hosts

Paul Beckett — 2013-06-19T15:07:08

Can mem_cache be configured to cache way more than you have memory, and swap out to disk for whatever is least popular?

Date: Wed, 19 Jun 2013 09:11:16 +1000
From: icicimov< at >gmail.com
To: users< at >httpd.apache.org
Subject: Re: [users< at >httpd] Disk Cache with multiple virtual hosts

On 18/06/2013 5:21 PM, "Paul Beckett" <paul_beckett< at >outlook.com> wrote:

Why not mem cache then? Why would you bother with ramdisk if you want to cache in memory?
 If I'm using a unique CacheRoot (a sub-directory in the tmpfs mount), is there anyway to configure Apache to create the CacheRoot directory if it doesn't already exist? If anyone has any thoughts / recommendations / tips in this regards to this approach I would be grateful to here them.

> Paul

Re: Enabling TCP fast open on apache

Robert Schoultz — 2013-06-19T06:52:28

Hello Leonas.

I _believe_ TCP_FASTOPEN is disabled in the kernel by default. Is it enabled?

Try this and see if it helps: echo 1 > /proc/sys/net/ipv4/tcp_fastopen

/Rob

On Sat, Jun 15, 2013 at 12:43 PM, Leonas Sutkevičius <neonasl< at >gmail.com> wrote:

Problem with orhpaned fcgi php processes

Lorenzo Milesi — 2013-06-19T06:05:32

Hi.

We have a webserver with apache 2.2.14, PHP 5.3.2.
PHP is executed using mod_fcgid (see bottom). Everything works fine but sometimes, and we still have to figure out what triggers this, when php processes are "rotated" they remain active and orphaned: apache spawns new php processes and the old ones remains on the system.
Killing them doesn't always kicks them away. More likely an "apache2ctl graceful" frees the system from this stale processes.
We found this in error log:
[Tue Jun 18 20:49:54 2013] [warn] mod_fcgid: process 2009 graceful kill fail, sending SIGKILL
from what I found searching around this is quite normal, but that's all I found in apache logs during one of this processes leak.

This event is luckily seldomly happening, usually apache and php operate normally and with no problems during fcgid childrens renewal. 
How can we understand what's going wrong in these situations?
thanks

maxxer

P.s. posting here some configs:

mod_fcgid config in site:
    <IfModule mod_fcgid.c>
      SuexecUse

Re: Protect server-status with https required?

Kevin A. McGrail — 2013-06-19T02:52:31

Thanks Jim.  That worked like a charm.

regards,
KAM

Re: Protect server-status with https required?

Jim Albert — 2013-06-19T02:11:31

This should be relevant:
http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslrequiressl

Jim

Protect server-status with https required?

Kevin A. McGrail — 2013-06-19T01:51:59

Hello All,

We are protecting server-status and info with basic auth using a config 
block similar to the following:

<Location /server-info>
     SetHandler server-info
     #Order deny,allow
     #Deny from all
     #Allow from .example.com
     AuthType basic
     AuthName "Apache Info"
     AuthUserFile /usr/local/apache2/conf/server-status_htpasswd
     Require valid-user
</Location>

Is there a a way to require https to access this Location?

Using a rewrite so far is a problem because to get to the rewrite, you 
have to enter the basic auth and that fails the PCI scan because it's 
consider cleartext access.  But perhaps that just because I've been 
trying a .htaccess and we can do it some other way?

Apologies if this is simple.  I've been getting bleary eyed looking at 
it and might be missing the forest for the trees.

Regards,
KAM

Re: Disk Cache with multiple virtual hosts

Igor Cicimov — 2013-06-18T23:11:16

pages, but am unsure whether I need a unique CacheRoot for each virtual
host, or whether multiple virtual hosts can/should share the same CacheRoot?
(effectively a ramdisk that will page out to swap space if theres not
enough ram to cache everything).

Why not mem cache then? Why would you bother with ramdisk if you want to
cache in memory?

If I'm using a unique CacheRoot (a sub-directory in the tmpfs mount), is
there anyway to configure Apache to create the CacheRoot directory if it
doesn't already exist? If anyone has any thoughts / recommendations / tips
in this regards to this approach I would be grateful to here them.

mod_speling serving bogus 300 responses

Stas Bekman — 2013-06-18T21:52:30

Hi,

Recently some massive bad image scraping sites started mangling the 
requests to the images on my site, I get thousands of requests to urls like:

   "/blah/blah/images/Image-5.jpg" width="128" height="49" 
alt="image"/></a> </div> <div class="c0 r"><a href="/m/imgres?..."

this is the request uri verbatim, not just a snippet of the html on the 
client side...

So google webmaster tools has been reporting tons of Soft 404 on my sites.

The problem is that I have mod_speling enabled and using it only to 
correct the case of the url:

         CheckSpelling On
         CheckCaseOnly On

For some reason the module doesn't behave correctly and offers a 300 
response:

--------&<------------&<----------
http://example.com/blah/blah/images/Image-5.jpg%22%20width=%22128%22%20height=%2249%22%20alt=%22image%22/%3E%3C/a%3E%20%3C/div%3E%20%3Cdiv%20class=%22c0%20r%22%3E%3Ca%20href=%22/m/imgres?q=foobar

Multiple Choices
The document name you requested (/blah/blah/images/Image-5.jpg" 
width="128" height="49" alt="im

Re: Proxy load balancer and (a)synchronous I/O

Eric Covener — 2013-06-18T15:23:01

On Tue, Jun 18, 2013 at 10:51 AM, marco.signorini< at >gmail.com
<marco.signorini< at >gmail.com> wrote:

The proxy is synchronous / ties up a thread while it's waiting for a
response from the backend.

Re: mod_remoteip: server-status page does not show real ip

Eric Covener — 2013-06-18T15:08:22

first half of my last update was incorrect and meant to zap it -- it
doesn't happen too early, it just seems to side-step mod_remoteip.

Re: mod_remoteip: server-status page does not show real ip

Eric Covener — 2013-06-18T15:07:47

The code mod_status displays seems to be set very early when there is
a TCP connection but no headers yet.  Apache 2.4 allows per-request
notion of overriding the client address, but not at this early stage.
I would suggest opening a bug report that the cores
update_child_status_internal() does not appear to be affected by
mod_remoteip which results in mod_status always showing physical
client address.

Re: mod_remoteip: server-status page does not show real ip

Володя К. — 2013-06-18T15:06:43


18.06.2013, 18:00, "David Guerra" <imdavidguerra< at >gmail.com>:

No,, I don't have mod_rpaf. But I have mod_remoteip ( apache-2.4)

Re: mod_remoteip: server-status page does not show real ip

David Guerra — 2013-06-18T15:05:16

I've never had luck getting remoteip fully working but I've got setups with
rpaf working with no issues.


On Tue, Jun 18, 2013 at 11:02 AM, Eric Covener <covener< at >gmail.com> wrote:

Re: mod_remoteip: server-status page does not show real ip

Eric Covener — 2013-06-18T15:02:05

Doesn't mod_remoteip supercede it?




--
Eric Covener
covener< at >gmail.com

Re: mod_remoteip: server-status page does not show real ip

David Guerra — 2013-06-18T14:59:36

You have mod rpaf installed?


On Tue, Jun 18, 2013 at 10:50 AM, Володя К. <vova-zms< at >yandex.ua> wrote:

Re: Proxy load balancer and (a)synchronous I/O

Tom Evans — 2013-06-18T14:56:13

On Tue, Jun 18, 2013 at 3:51 PM, marco.signorini< at >gmail.com
<marco.signorini< at >gmail.com> wrote:

Apache can run any model you choose:

http://httpd.apache.org/docs/2.4/mpm.html

Cheers

Tom

Proxy load balancer and (a)synchronous I/O

2013-06-18T14:51:45

Hi users,

I'm configuring the apache httpd server in front of a farm of cometd
servers. The clients interact with the cometd server through long polling
connections.

Does the httpd server still use a thread-per-request model? In my usecase
this means that a thread per client will be "active".
http://cometd.org/node/81

Thanks,
Marco

Re: mod_remoteip: server-status page does not show real ip

Володя К. — 2013-06-18T14:50:11


18.06.2013, 17:03, "David Guerra" <imdavidguerra< at >gmail.com>:

David, but after enabling mod_remoteip apache writes real IP-address is log files ! So I think apache accepts real ip from nginx.
Problem is that mod-status does not show real ip!

I think I configure module incorectly or this is apache's bug

Re: mod_remoteip: server-status page does not show real ip

David Guerra — 2013-06-18T14:03:12

This should be helpful.
http://www.daveperrett.com/articles/2009/08/10/passing-ips-to-apache-with-nginx-proxy/

The issue is with Apache not accepting the real IP address from Nginx.


On Tue, Jun 18, 2013 at 5:39 AM, Володя К. <vova-zms< at >yandex.ua> wrote: