Apache shows code when using IP address

------=_Part_45_19931239.1257784212547
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit

Hi Everyone,

Forgive me if this seems like a stupid oversight on my part, but I've setup an Apache 2.2.x server with Resin and Railo for my ColdFusion site. This is all running on Ubuntu 9.04 Server. When I call the site by it's domain name, all is well. However, if I use the IP address of the site, it just shows the ColdFusion code of my page. I know this is probably just a simple config error on my part, but I'm stumped. I'm using virtual hosting like this:


NameVirtualHost x.x.x.x:80 (x.x.x.x being my IP address)
NameVirtualHost x.x.x.x:443

# MYSITE.COM (NON-SSL)

ServerAdmin me@mysite.com
ServerName www.mysite.com
ServerAlias mysite.com

DocumentRoot /var/www/mysite.com/www/


Options -Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all




# MYSITE.COM (SSL)

ServerAdmin me@mysite.com
ServerName www.mysite.com
ServerAlias mysite.com

DocumentRoot /var/www/mysite.com/www/


Options -Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all


SSLEngine On
SSLProtocol -all +TLSv1 +SSLv3
SSLCipherSuite HIGH:MEDIUM:!aNULL:+SHA1:+MD5:+HIGH:+MEDIUM
SSLCertificateFile "/var/www/mysite.com/ssl/mysite.crt"
SSLCertificateKeyFile "/var/www/mysite.com/ssl/mysite.key"


If you need more config info, I'd be happy to provide it, but any help would be much appreciated.

Thanks,

Tanner

------=_Part_45_19931239.1257784212547
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<=
div style=3D'font-family: Arial; font-size: 12pt; color: #000000'>Hi =
Everyone,

Forgive me if this seems like a stupid oversight on my par=
t, but I've setup an Apache 2.2.x server with Resin and Railo for my ColdFu=
sion site.  This is all running on Ubuntu 9.04 Server.  When I ca=
ll the site by it's domain name, all is well.  However, if I use the I=
P address of the site, it just shows the ColdFusion code of my page. I know=
this is probably just a simple config error on my part, but I'm stumped.&n=
bsp; I'm using virtual hosting like this:

Re: Apache shows code when using IP address

------=_Part_51_23671471.1257785102029
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit

Sorry for wasting your time...I got it figured out. Apparently the IP address must be added to the Resin server as a virtualhost, so that Resin knows what to do with those requests.

Thanks,


Tanner


----- Original Message -----
From: "Tanner Bachman"
To: users@httpd.apache.org
Sent: Monday, November 9, 2009 9:30:12 AM
Subject: [users@httpd] Apache shows code when using IP address


Hi Everyone,

Forgive me if this seems like a stupid oversight on my part, but I've setup an Apache 2.2.x server with Resin and Railo for my ColdFusion site. This is all running on Ubuntu 9.04 Server. When I call the site by it's domain name, all is well. However, if I use the IP address of the site, it just shows the ColdFusion code of my page. I know this is probably just a simple config error on my part, but I'm stumped. I'm using virtual hosting like this:


NameVirtualHost x.x.x.x:80 (x.x.x.x being my IP address)
NameVirtualHost x.x.x.x:443

# MYSITE.COM (NON-SSL)

ServerAdmin me@mysite.com
ServerName www.mysite.com
ServerAlias mysite.com

DocumentRoot /var/www/mysite.com/www/


Options -Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all




# MYSITE.COM (SSL)

ServerAdmin me@mysite.com
ServerName www.mysite.com
ServerAlias mysite.com

DocumentRoot /var/www/mysite.com/www/


Options -Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all


SSLEngine On
SSLProtocol -all +TLSv1 +SSLv3
SSLCipherSuite HIGH:MEDIUM:!aNULL:+SHA1:+MD5:+HIGH:+MEDIUM
SSLCertificateFile "/var/www/mysite.com/ssl/mysite.crt"
SSLCertificateKeyFile "/var/www/mysite.com/ssl/mysite.key"


If you need more config info, I'd be happy to provide it, but any help would be much appreciated.

Thanks,

Tanner

------=_Part_51_23671471.1257785102029
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<=
div style=3D'font-family: Arial; font-size: 12pt; color: #000000'>Sor=
ry for wasting your time...I got it figured out.  Apparently the IP ad=
dress must be added to the Resin server as a virtualhost, so that Resin kno=
ws what to do with those requests.

Thanks,

Re: Apache shows code when using IP address

Tanner Bachman wrote:
> Hi Everyone,
>
> Forgive me if this seems like a stupid oversight on my part, but I've setup an Apache 2.2.x server with Resin and Railo for my ColdFusion site. This is all running on Ubuntu 9.04 Server. When I call the site by it's domain name, all is well. However, if I use the IP address of the site, it just shows the ColdFusion code of my page. I know this is probably just a simple config error on my part, but I'm stumped. I'm using virtual hosting like this:
>
>
> NameVirtualHost x.x.x.x:80 (x.x.x.x being my IP address)
> NameVirtualHost x.x.x.x:443
>
> # MYSITE.COM (NON-SSL)
>
> ServerAdmin me@mysite.com
> ServerName www.mysite.com
> ServerAlias mysite.com
>
> DocumentRoot /var/www/mysite.com/www/
>
>
> Options -Indexes FollowSymLinks
> AllowOverride None
> Order allow,deny
> Allow from all
>
>
>
>
> # MYSITE.COM (SSL)
>
> ServerAdmin me@mysite.com
> ServerName www.mysite.com
> ServerAlias mysite.com
>
> DocumentRoot /var/www/mysite.com/www/
>
>
> Options -Indexes FollowSymLinks
> AllowOverride None
> Order allow,deny
> Allow from all
>
>
In very summary (and you should *really* read the VirtualHost
documentation on the Apache website) :

Within each listening port (above : 80 and 443), the first VirtualHost
which you define (top to bottom) is also the *default* VirtualHost.
That means that, whichever way the browser establishes a connection to
your server, Apache will use that default VirtualHost configuration,
/unless/ it finds an exact match between the hostname requested, and one
of the defined VirtualHost "ServerName" or "ServerAlias".

In other words, when you enter in your browser
http://(ip-address):80/
it will look at all VirtualHosts defined for port 80, trying to match
(ip-address) with a ServerName or ServerAlias.
Since it does not find any, it will default to the first VirtualHost.

That is the first issue.
The second one is that in your configuration, you use the same
DocumentRoot for both your VirtualHosts.
But the configuration of these hosts is different.
In other words, anyone can bypass whatever you put as directives in the
second host, by adressing the first one.

Suggestion :
- define a new first VirtualHost :80, before the existing one for port
80, and set its DocumentRoot to something harmless (create a directory
with just a dummy page), and use that directory as DocumentRoot.
Give it a
ServerName www.mysite.default
(it does not matter which name, as long as it is not www.mysite.com).
This new host will then (by virtue of being the first one named) become
the default host, and people will get that one when they input an IP
address instead of the registered hostname.

Then let's take it from there.
But read the doc first. There is a special page dedicated to VirtualHosts.



------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Apache shows code when using IP address

Tanner Bachman wrote:
> Sorry for wasting your time...I got it figured out. Apparently the IP address must be added to the Resin server as a virtualhost, so that Resin knows what to do with those requests.
>
That may be a "patch", but it is not the correct explanation.
See my previous post.

To see why it may not be the correct patch, try to enter your IP address
with an extra zero that should not normally matter, for example :
if your IP address was
100.200.21.123
then try
http://100.200.021.123/...



------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Apache shows code when using IP address

At 18:12 +0100 11/9/09, Andr=E9 Warnier wrote:
>To see why it may not be the correct patch, try to enter your IP address=
with an extra zero that should not normally matter, for example :
>if your IP address was
>100.200.21.123
>then try
>http://100.200.021.123/...

I once tried adding zeros like that and got quite surprised.

021 as above gets interpreted as an octal number in accordance with IP and C=
standards so that 100.200.021.123 equivalent to 100.200.17.123
--

--> A fair tax is one that you pay but I don't <--

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Apache shows code when using IP address

------=_Part_102_2458836.1257791386454
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

So far everything seems to be working normally. I'm aware of Apache using t=
he first VirtualHost directive as the default...and that's fine with me. Si=
nce the sites hosted on this server both belong to the same company, I'd ra=
ther have it default to the public site if the IP address is used. The main=
problem was the Servlet Container (Resin) tied to Apache. It wasn't defaul=
ting to the first VirtualHost like Apache does, so it would just spit the c=
ode directly back to Apache and display it. Once I told it how to handle th=
e IP address...all was right with the world. :)=20

I didn't, however, ever think about adding an extra zero into the IP addres=
s. Great idea!=20

Here are the results of my test (using 10.10.010.200 as my test IP)=20

Firefox 3.5.5 - Gives a stock "Problem loading page" message.=20
IE 8 - Converts it too 10.10.8.200 and then sends it through Google.=20
Safari 3.1.2 - Gives a stock "Can't open the page" message.=20
Opera 9.62 - Also gives a stock error message.=20

I'll continue to play with this, but so far so good. I really appreciate ev=
eryone's quick responses.=20

Viva la Open Source! :)=20

Thanks,=20


Tanner=20


----- Original Message -----=20
From: "André Warnier" =20
To: users@httpd.apache.org=20
Sent: Monday, November 9, 2009 10:07:54 AM=20
Subject: Re: [users@httpd] Apache shows code when using IP address=20

Tanner Bachman wrote:=20
> Hi Everyone,=20
>=20
> Forgive me if this seems like a stupid oversight on my part, but I've set=
up an Apache 2.2.x server with Resin and Railo for my ColdFusion site. This=
is all running on Ubuntu 9.04 Server. When I call the site by it's domain =
name, all is well. However, if I use the IP address of the site, it just sh=
ows the ColdFusion code of my page. I know this is probably just a simple c=
onfig error on my part, but I'm stumped. I'm using virtual hosting like thi=
s:=20
>=20
>=20
> NameVirtualHost x.x.x.x:80 (x.x.x.x being my IP address)=20
> NameVirtualHost x.x.x.x:443=20
>=20
> # MYSITE.COM (NON-SSL)=20
> =20
> ServerAdmin me@mysite.com=20
> ServerName www.mysite.com=20
> ServerAlias mysite.com=20
>=20
> DocumentRoot /var/www/mysite.com/www/=20
>=20
> =20
> Options -Indexes FollowSymLinks=20
> AllowOverride None=20
> Order allow,deny=20
> Allow from all=20
> =20
>=20
> =20
>=20
> # MYSITE.COM (SSL)=20
> =20
> ServerAdmin me@mysite.com=20
> ServerName www.mysite.com=20
> ServerAlias mysite.com=20
>=20
> DocumentRoot /var/www/mysite.com/www/=20
>=20
> =20
> Options -Indexes FollowSymLinks=20
> AllowOverride None=20
> Order allow,deny=20
> Allow from all=20
> =20
>=20
In very summary (and you should *really* read the VirtualHost=20
documentation on the Apache website) :=20

Within each listening port (above : 80 and 443), the first VirtualHost=20
which you define (top to bottom) is also the *default* VirtualHost.=20
That means that, whichever way the browser establishes a connection to=20
your server, Apache will use that default VirtualHost configuration,=20
/unless/ it finds an exact match between the hostname requested, and one=20
of the defined VirtualHost "ServerName" or "ServerAlias".=20

In other words, when you enter in your browser=20
http://(ip-address):80/=20
it will look at all VirtualHosts defined for port 80, trying to match=20
(ip-address) with a ServerName or ServerAlias.=20
Since it does not find any, it will default to the first VirtualHost.=20

That is the first issue.=20
The second one is that in your configuration, you use the same=20
DocumentRoot for both your VirtualHosts.=20
But the configuration of these hosts is different.=20
In other words, anyone can bypass whatever you put as directives in the=20
second host, by adressing the first one.=20

Suggestion :=20
- define a new first VirtualHost :80, before the existing one for port=20
80, and set its DocumentRoot to something harmless (create a directory=20
with just a dummy page), and use that directory as DocumentRoot.=20
Give it a=20
ServerName www.mysite.default=20
(it does not matter which name, as long as it is not www.mysite.com).=20
This new host will then (by virtue of being the first one named) become=20
the default host, and people will get that one when they input an IP=20
address instead of the registered hostname.=20

Then let's take it from there.=20
But read the doc first. There is a special page dedicated to VirtualHosts.=
=20



------------------------------------------------------------ ---------=20
The official User-To-User support forum of the Apache HTTP Server Project.=
=20
See for more info.=20
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org=20
" from the digest: users-digest-unsubscribe@httpd.apache.org=20
For additional commands, e-mail: users-help@httpd.apache.org=20


------=_Part_102_2458836.1257791386454
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<=
div style=3D'font-family: Arial; font-size: 12pt; color: #000000'>So =
far everything seems to be working normally.  I'm aware of Apache usin=
g the first VirtualHost directive as the default...and that's fine with me.=
  Since the sites hosted on this server both belong to the same compan=
y, I'd rather have it default to the public site if the IP address is used.=
  The main problem was the Servlet Container (Resin) tied to Apache.&n=
bsp; It wasn't defaulting to the first VirtualHost like Apache does, so it =
would just spit the code directly back to Apache and display it.  Once=
I told it how to handle the IP address...all was right with the world. :)<=
br>
I didn't, however, ever think about adding an extra zero into the IP=
address.  Great idea!

Here are the results of my test (using 1=
0.10.010.200 as my test IP)

Firefox 3.5.5 - Gives a stock "Problem =
loading page" message.
IE 8 - Converts it too 10.10.8.200 and then sends=
it through Google.
Safari 3.1.2 - Gives a stock "Can't open the page" m=
essage.
Opera 9.62 - Also gives a stock error message.

I'll conti=
nue to play with this, but so far so good.  I really appreciate everyo=
ne's quick responses.

Viva la Open Source! :)

Thanks,

=

Re: Apache shows code when using IP address

Tanner Bachman wrote:
> So far everything seems to be working normally. I'm aware of Apache using the first VirtualHost directive as the default...and that's fine with me. Since the sites hosted on this server both belong to the same company, I'd rather have it default to the public site if the IP address is used. The main problem was the Servlet Container (Resin) tied to Apache. It wasn't defaulting to the first VirtualHost like Apache does, so it would just spit the code directly back to Apache and display it. Once I told it how to handle the IP address...all was right with the world. :)
>
> I didn't, however, ever think about adding an extra zero into the IP address. Great idea!
>
> Here are the results of my test (using 10.10.010.200 as my test IP)
>
> Firefox 3.5.5 - Gives a stock "Problem loading page" message.
> IE 8 - Converts it too 10.10.8.200 and then sends it through Google.
> Safari 3.1.2 - Gives a stock "Can't open the page" message.
> Opera 9.62 - Also gives a stock error message.
>
Did you try to use your real IP (modified with an extra 0) ? or isn't it
one that lends itself to this ?

When I do that with my (real) IP address, I do get my default host.
The IP I am using is like xxx.yyy.38.zzz, and I change the 38 to 038.
But neither with FF 3.5 nor IE 7 does it interpret 038 as octal (which,
granted, would be kind of difficult).
Unfortunately, I do not have right now an IP available to test with,
where the octal conversion would be possible.

What happens in fact is that the server takes the IP address as given
(and which arrives in a "Host:" header) /as a string/, and compares that
string to the various ServerName and ServerAlias, thus defaulting to the
default host most of the time.

To get back to your case, my personal view is that letting things
"default", is running a risk of forgetting this after a while, and then
get into some kind of vicious unplanned situation some day in the
future, when you make what you believe is a harmless change.


------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org