configuration - Can I use nested directives in .htaccess in Apache 2.4

I am trying to simulate the permalink structure of a previous version of my site using Redirect and RedirectMatch rules in my .htaccess file.

I have different rules that I would to apply to different paths from my old site. Some directories have no analogue and I want them to redirect to a single location. Some directories contain many items (thousands) at varying locations and I want them to redirect smartly to their correct new locations in the new site.

It seems that I could guard and group related items with a basic regex test on to prevent all the contained grouped redirects from being tested if they would never match. In this method, the resulting configuration looks logical and coherent and can be easily auto-generated:

    # These rules aren't considered if the request wasn't for a subpath of categories/software.

    
        # All old store pages now invalid, go to main store.    
        RedirectMatch 301 .* /software-store/
    

    # Regexes for each category of software to group them logically.
    # And so that 1,000s of redirects don't get considered on each page load.

    
        # Loads and loads of redirect lines for pages with arbitrary rules to product pages.
        Redirect 301 "/categories/software/item/foo" /software-store/games/foo
        Redirect 301 "/categories/software/item/bar" /software-store/productivity/bar
        Redirect 301 "/categories/software/item/baz" /software-store/misc/baz
        # ...
    
    
        # Loads and loads of redirect lines. It could also be grouped into subdirectories of dlc/ and so on.
        # ...

    

# ...

For a huge catalogue, a few guarding regexes can prevent thousands of useless tests.

I'm using Apache 2.4, where the directive is available, but the above directives aren't having the effect I expect. The interior s are being ignored completely.

If I remove the enclosing and just have the innermost s present the rules work, so I don't believe that my syntax or my Redirect rules are at fault.

I suspect that the problem is that I can't nest s, although this seems like a very common thing to want to do. I can't see any reference to nesting, allowed or otherwise, in the documentation.
http://httpd.apache.org/docs/2.4/mod/core.html#if

Can I nest directives? And if so/if not so, can you point me to the section of the documentation that says why.

ssl - Centos 5.11 OpenSSL TLS 1.2 for Paypal

I run a website on a server running Centos 5.11 - EOL now I know but an upgrade is not possible for a while. The website runs the Sellerdeck software which integrates with Paypal for payments.

In the next month or so Paypal will require me to be using TLS 1.2 [1] for connections to them, which is not supported by the default OpenSSL version installed in 5.11 (0.9.8b).

I have followed instructions [2] to install a second version of OpenSSL, and a second version of Curl linked to that new version of OpenSSL, which will support TLS 1.2, but it still doesn't pass the Paypal Test.

Centos 5.11 with OpenSSL 1.0.2k in /usr/local/:

/usr/local/bin/curl https://tlstest.paypal.com
curl: (35) Unknown SSL protocol error in connection to tlstest.paypal.com:443

Centos 6.9 with OpenSSL 1.0.1e-fips

curl https://tlstest.paypal.com
PayPal_Connection_OK

Can anyone help point me in the right direrction as to why the connection is not working with the updated OpenSSL?

Thanks very much

Kevin

1 - https://www.paypal-knowledge.com/infocenter/index?page=content&widgetview=true&id=FAQ1914&viewlocale=en_US

2 - https://miteshshah.github.io/linux/centos/how-to-enable-openssl-1-0-2-a-tlsv1-1-and-tlsv1-2-on-centos-5-and-rhel5/

Verbose non-working output:

/usr/local/bin/curl -Ivvv https://tlstest.paypal.com
* Rebuilt URL to: https://tlstest.paypal.com/
*   Trying 23.67.159.210...
* Connected to tlstest.paypal.com (23.67.159.210) port 443 (#0)
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt

  CApath: none
* TLSv1.0, TLS handshake, Client hello (1):
* Unknown SSL protocol error in connection to tlstest.paypal.com:443
* Closing connection 0
curl: (35) Unknown SSL protocol error in connection to tlstest.paypal.com:443

Verbose working output:

curl -Ivvv https://tlstest.paypal.com

* About to connect() to tlstest.paypal.com port 443 (#0)
*   Trying 23.214.50.150... connected
* Connected to tlstest.paypal.com (23.214.50.150) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
*       subject: CN=tlstest.paypal.com,OU=CDN Support,O="PayPal, Inc.",STREET=2211 N 1st St,L=San Jose,ST=California,postalCode=95131-2021,C=US,serialNumber=3014267,businessCategory=Private     Organization,incorporationState=Delaware,incorporationCountry=US
*       start date: Nov 06 00:00:00 2015 GMT

*       expire date: Oct 26 23:59:59 2017 GMT
*       common name: tlstest.paypal.com
*       issuer: CN=Symantec Class 3 EV SSL CA - G3,OU=Symantec Trust     Network,O=Symantec Corporation,C=US
> HEAD / HTTP/1.1
> User-Agent: curl/7.19.7 (i386-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1     zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: tlstest.paypal.com
> Accept: */*
>
< HTTP/1.1 200 OK
HTTP/1.1 200 OK

< Content-Type: text/html
Content-Type: text/html
< Content-Length: 20
Content-Length: 20
< Date: Sat, 06 May 2017 12:58:47 GMT
Date: Sat, 06 May 2017 12:58:47 GMT
< Connection: keep-alive
Connection: keep-alive
<
* Connection #0 to host tlstest.paypal.com left intact

* Closing connection #0

Compile apache 2.2.23 on Ubuntu 12.04.1 LTS with openssl error

I have (or am) moved from OpenSuse 12.1 to Ubuntu 12.04.1 LTS -- I have had no problems compiling apache from source on our OpenSUSE boxes.. However, I have run into a problem with Ubuntu 12.04.1 LTS.

I have installed openssl, libssl-dev and when I attempt to compile apache, I receive the following:

checking for SSL/TLS toolkit base... /usr

checking for SSL/TLS toolkit version... OpenSSL 1.0.1 14 Mar 2012

checking for SSL/TLS toolkit includes... /usr/include

checking for SSL/TLS toolkit libraries... configure: error: OpenSSL libraries not found

I have attempted to use --with-ssl=/usr/include/openssl but that did not work either.

Do I need to compile SSL from source as well (I did not need to do this on our SUSE boxes).

Thank You.

Note : I am required to compile Apache for various business reasons, using apt-get apache2 is not an option for me.

Edit : I have libssl.so.1.0.0 in /lib/x86_64-linux-gnu and configure option --libdir=/lib/x86_64-linux-gnu

Answer

Compile openssl, then compile and link Apache against --with-ssl=/usr/local/ssl (the default path). Don't forget "--enable-so"

I had many issue with the maintainer libs from debian distros and always compile openssl from scratch.

If you are using PHP and use --with-openssl=/usr/local/ssl, the same libraries have to be used.

rewrite rule setting in nginx

I install nginx 1.0.0 and i installed it /usr/local/nginx1.0.0/.
and I try to modify /usr/local/nginx1.0.0/cont/nginx.conf file.

I just copy default file. and replace server_name and root path

and I connected example.com -> it works (there is nginx working message.)

but I connected www.example.com -> it is not working.(there is 404 Not Found message.)

and url is =

http://www.example.com/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/index.php/

and I try to server_name => example.com *.example.com (but same problum)

this is my nginx.conf code.
am i wrong config? or wrong install?

server {
        listen       80;
        server_name  .example.com;


        location / {
            root   html;
            index  index.html index.htm;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }


      location ~ \.php$ {
            root           html;
            fastcgi_pass   127.0.0.1:9000;
            fastcgi_index  index.php;
            fastcgi_param  SCRIPT_FILENAME  html$fastcgi_script_name;
            include        fastcgi_params;
        }

        location ~ /\.ht {

            deny  all;
        }
    }

ssl - Apache won't start with new certificate

Hi I'm trying to renew my SSL certificate and Apache refuses to start when I change the paths to the new certificate file. I'm running Apache 2.2 on CentOS 6.6.

When I try to start Apache this is in /var/log/httpd/ssl_error_log:

[Sun Dec 07 20:00:29 2014] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)

[Sun Dec 07 20:00:29 2014] [warn] RSA server certificate CommonName (CN) `proposify' does NOT match server name!?

It's a wildcard certificate for *.domain.com (same as before). What am I doing wrong?

Thanks!

[ edit ]

One thing I noticed is in the new private key has more info at the top and the old one just has the key. Should I remove the info so the actual key starts under -----BEGIN RSA PRIVATE KEY-----?

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: NUMBER,NUMBER

... long string of numbers/chars ....

The original files were in:

/etc/httpd/conf.d/ssl/domain.com

The new files are in:

/etc/httpd/conf.d/ssl/domain

So in my VHOST all I'm doing is removing the ".com" in the key, certificate, and chainfile entries. The private key, certificate, and intermediate certificate all have the same names as before. I ran cat on them all to confirm they have the correct contents.

Answer

... to renew my SSL certificate ...

[warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[warn] RSA server certificate CommonName (CN) `proposify' does NOT match server name!?

It's a wildcard certificate for *.domain.com (same as before). What am I doing wrong?

Your statements do not match with the error messages. Since you are renewing the certificate is probably not self-signed, so it should not be a CA certificate as shown by the warning message. Also, the second warning shows that the certficate does not seem to match the hostname.

Please check the contents of your certificate files with openssl x509 -text or similar tools.

lvm - RAID / FS choice for 12 hard drive machine?

I'm going to purchase a 14 bay HP 2U server with ECC memory and bunch of 3TB enterprise SATA drives. I would prefer to make 2 x RAID6 with 6 drive each. This will be used for local office storage and my Internet crawler.

I am flooded with FS/RAID choices. I am wondering should I use Hardware Raid Card, LVM, mdadm, btrfs, fuse zfs? will likely to use debain/ubuntu as OS.

My priority of concerns is:

1. data security, no loss, no corruption (most important)


2. reasonable performance


3. minimal maintenance and easier recovery/replacement if anything goes wrong

Has anyone with production experience?

EDIT: add fuse-zfs

Answer

The best option for data security is ZFS data encryption, ans for no corruption Best data reliability is provided by ZFS as well. ZFS has its own RAID (which is software RAID), that can help you a lot in this case to build RAID/Mirror or many types, based on your needs. you can even have Spare drives to be added in a ZFS RAID , as just in case one drive fails, it is automatically replaced with spare drive. Also, in case of ZFS, RAID re-construction is fastest, as it does not re-calculate every block on drive, but intelligently only recovers the data that needs to be reconstructed. Also, in case of ZFS, RAID is much more reliable as it provides some sort of Raid5/6 (named as RaidZ/Raidz2/RaidZ3) parity does not needs to be calculated again and again (as its done in traditional RAID5/6...

For Extreme performance, just use ZFS cachings over a 100-400GB SSD Drive (based on your needs), so all of your reads/writes can be cached and you can get IOPS of more than 10,000+ (if tuned properly) as compared to 14 drive RAID, which can give you 14x read speed (appx 1500-2000 IOPS)...

Dont go for btrfs, as its slowest filesystem.

windows - Microsoft Azure Remote App User Folder Permissions

We are exploring Microsoft Azure Remote App as a solution for running a Windows-only version of Quickbooks in our Mac-centric environment. This solution meets the objectives of extending application functionality in a secure and isolated manner, while eliminating some of the overhead and cost of deploying a full terminal services infrastructure. One challenge we are facing is where best to store our Quickbooks data file such that any Remote App user can access it.

Microsoft recommends that you "Store all user data in user profiles or other storage locations external to the service, such as on-premises file shares or OneDrive" in Remote App Best Practices.

Since each user profile is folder redirected to 50GB data volume, and our Quickbooks file is less than 100MB, my thought was to store the Quickbooks file in the user folder of one of our users and simply use file system ACL's to allow the other users access. No data other than a single Quickbooks file will be stored and all 3 users can have equal access.

I was able to successfully grant the other users access to the requisite user folder and apply the necessary permissions by temporarily publishing Explorer as a remote app to interact with the file system. However, when I test access the other user do not have sufficient access.

• Is what I am trying to accomplish even possible in this context?



• How else might I accomplish sharing the Quickbooks data file amongst users within the Remote App environment?

Answer

Azure RemoteApp profile storage is stored as VHD's which are mounted to the users profile when they login, so if the user who has the document is not logged in the folder won't be accessible, it's also possible permissions will be reset when it is mounted.

If you can't use a service like OneDrive, then one thing you could use is Azure Files, which will allow you to map a drive to an Azure storage account, and all users can share this location. The only issue with this is that access is via storage key, which will be visible to all users who need to map the drive and so they could take this key and access the storage from other machines, or if they leave the company (and you don't rotate it). If this is not an issue then this would likely work well.