strange connections to apache2 port 443

Hi,

I hope that I describe my problem to the right mailinglist and that
someone can give me the hint I need.

I´m running a SuSE Linux 9.0 with Apache2 2.0.53 ( installed via rpm
from ftp.suse.com ) with mod_ssl. The startup parameter for the apache
is "-D SSL".

But here comes my problem ... I´m also running an iptables firewall and
I notice a strange behaviour on my system but only when I start apache
with "-D SSL". When I run apache only with http there are no strange
connection attempts in the firewall logs.

To be more precise, my firewall logs show entries of connection attampts
from my localhost to my localhost via interface lo ( not eth0 ) from
some increacing port to port 443.

Fact is that this connections only appear when I start the apache with
"-D SSL" and I can also comment out all the virtual hosts for port 443
but that does not matter, only when I start the apache without SSL the
connections disappear.
The strange thing is that in the firewall logs there are syn, ack ...
flags but I can not find any apache2-logfile entry for one of this
connections.

Does that sound familiar to somebody?
Is there a configuration withtin the apache2 to probe the ssl aware
apache?

Kind regards

Tom


____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users@modssl.org
Automated List Manager majordomo@modssl.org

Re: strange connections to apache2 port 443

Tom Henderson wrote:
> Hi,
>=20
> I hope that I describe my problem to the right mailinglist and that
> someone can give me the hint I need.
>=20
> I=B4m running a SuSE Linux 9.0 with Apache2 2.0.53 ( installed via rpm
> from ftp.suse.com ) with mod_ssl. The startup parameter for the apache
> is "-D SSL".
>=20
> But here comes my problem ... I=B4m also running an iptables firewall a=
nd
> I notice a strange behaviour on my system but only when I start apache
> with "-D SSL". When I run apache only with http there are no strange
> connection attempts in the firewall logs.
>=20
> To be more precise, my firewall logs show entries of connection attampt=
s
> from my localhost to my localhost via interface lo ( not eth0 ) from
> some increacing port to port 443.
>=20
> Fact is that this connections only appear when I start the apache with
> "-D SSL" and I can also comment out all the virtual hosts for port 443
> but that does not matter, only when I start the apache without SSL the
> connections disappear.
> The strange thing is that in the firewall logs there are syn, ack ...
> flags but I can not find any apache2-logfile entry for one of this
> connections.
>=20
> Does that sound familiar to somebody?
> Is there a configuration withtin the apache2 to probe the ssl aware
> apache?


Hi Tom,

this is exactly what I recognized. When Apache 2.0.54 runs on RHEL AS 3=20
using SSL, it opens TCP connections to itself on a regular schedule.

The connections to port 443/tcp are opened by the apache parent process=20
running as root. No information is exchanged. The TCP connection is just=20
opened and immediately closed (FIN sent by the "client").
This was seen by iptabling 443/tcp on interface lo and watching which=20
process had connections in the SYN_SENT state.

The error_log with "LogLevel debug" shows lots of SSL handshake errors=20
even when no browser causes a SSL handshake error.

Here's how apache was built:

# 22.08.05
# httpd-2.0.54
#
CFLAGS=3D"-I/usr/kerberos/include" \
../configure \
--prefix=3D/opt/apache \
--sysconfdir=3D/etc/httpd/conf \
--enable-ssl \
--enable-mods-shared=3Dall \
--enable-proxy \
--enable-proxy-http \
--enable-dumpio

Best regards,
Bernie
____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users@modssl.org
Automated List Manager majordomo@modssl.org

Re: strange connections to apache2 port 443

On Wed, Aug 31, 2005 at 10:47:39AM +0200, Bernhard Erdmann wrote:
> this is exactly what I recognized. When Apache 2.0.54 runs on RHEL AS 3
> using SSL, it opens TCP connections to itself on a regular schedule.

2.0 does this to wake up idle child processes, which can then exit, it's
perfectly normal - you should modify the firewall rules to allow local
connections to all listening ports.

joe
____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users@modssl.org
Automated List Manager majordomo@modssl.org