last day (15 days later) » 

8:09 PM
0
Q: Server apache multiple virtualhost on same server

Marc RasmussenI am trying to setup a virtualhost / redirection point so i can have two different systems on one site. so far this is what i have: NameVirtualHost 89.104.220.207:80 NameVirtualHost 89.104.220.207:1500 # # NOTE: NameVirtualHost cannot be used without a port specifier # (e.g. :80) if mod...

 
well when i try to enter the ip for the system_learningbank nothing happens or well i get an error. if you go to 89.104.220.207:1500 you will see that you get an error
 
Do you have Listen 1500 in your config? Also, check firewalls.
 
@garethTheRed when i do this and restart i get the following Stopping httpd: [ OK ] Starting httpd: httpd: Could not reliably determine the server's fully qualified domain name, using 89.104.220.207 for ServerName [Thu Aug 28 21:55:28 2014] [warn] NameVirtualHost 89.104.220.207:1500 has no VirtualHosts (13)Permission denied: make_sock: could not bind to address [::]:1500 (13)Permission denied: make_sock: could not bind to address 0.0.0.0:1500 no listening sockets available, shutting down Unable to open logs
 
What distro are you using?
 
@garethTheRed distro?
 
8:09 PM
Sorry - what operating system are you running apache on?
 
im using CentOS 6
 
Just a few questions then:
You did start that as `root`?
Do you have `SELinux` enabled?
 
i am root
and im logged in using ssh
 
And SELinux?
 
What is that?
 
8:14 PM
It's a security "thing". Type getenforce an post the reply.
 
sure give me a minute
[root@BUSINESSPOWER ~]# getenforce
Enforcing
[root@BUSINESSPOWER ~]#
 
Temporarily disable it with setenforce 0 and see if apache will start.
 
[root@BUSINESSPOWER ~]# setenforce 0
[root@BUSINESSPOWER ~]# sudo /etc/init.d/httpd restart
Stopping httpd: [FAILED]
Starting httpd: httpd: Could not reliably determine the server's fully qualified domain name, using 89.104.220.207 for ServerName
[ OK ]
[root@BUSINESSPOWER ~]#
 
That's started, although I still can't get my browser to view the page. Do you have the firewall enabled?
 
can i check that in some way sorry im quite new to Centos
 
8:20 PM
We'll try! I'm not running CentOS 6 myself at the moment, so I'll be working blind.
 
haha well but are we sure that my virtualhost is setup correctly?
also
 
We can't be certain until we can access it. That's why we need to make sure that your firewall isn't blocking anything as it could lead us down the wrong path.
 
ahh ok
 
Type ss -lt and see if the LocalAddress:Port column has *:1500 (or anything :1500) in it. That will show if your server has something listening on port 1500 - hopefully it's apache
 
il copy paste the response
[root@BUSINESSPOWER ~]# ss -lt
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 50 *:mysql *:*
LISTEN 0 128 :::http
 
8:26 PM
That's fine. The command checks for a human friendly name for the service. The service that normally runs on port 1500 is vlsi-lm (whatever that is) which is why it's shown as the last line.
Now run iptables -L and post the results.
 
[root@BUSINESSPOWER ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:http
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:mysql
 
That shows that your server will accept http, ssh and mysql but blocks everything else. http is only the default port 80, so we need to open the firewall up for http on port 1500.
 
ahh okay that makes sence :D
how do we do that ? :D
 
iptables -I INPUT -p tcp --dport 1500 -j ACCEPT
 
ok done
should there be a response when doing that?
 
8:30 PM
I see a web page!!!!!!!!
Now we need to tidy things up.
 
ahh 2 sec :D
Holy fuck
your a genious!
 
The last command you entered basically said open the firewall up (ACCEPT) for an INPUT coming in using protocol TCP (-p tcp) to port 1500 (-dport 1500). It will not last a reboot though. So make it permanent with: service iptables save.
 
[root@BUSINESSPOWER ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
[root@BUSINESSPOWER ~]#
 
Good. That should make it last a reboot. The only thing left now is SELinux. You disabled it temporarily before. We can't enable it again at the moment as apache will fail to start. However, it's there for the security of your server, so we need to configure it so that it allows apache to start when enabled. Give me a second or two...
Do you have the semanage command installed? Type it in and see.
 
hang one 1 sec
[root@BUSINESSPOWER ~]# semanage
-bash: semanage: command not found
[root@BUSINESSPOWER ~]#
 
8:41 PM
Try: yum install policycoreutils-python
 
installing atm
 
Great - we're nearly there...
 
Complete!
 
semanage port -l | grep '^http_port_t' and make sure you have at least 80 and 443 in the results.
 
[root@BUSINESSPOWER ~]# semanage port -l | grep '^http_port_t'
http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000
[root@BUSINESSPOWER ~]#
after this conversation i have to save all of what you said you really were an amazing help!
 
8:47 PM
That lists the ports that SELinux believes apache is allowed to use. As you can see, 1500 isn't there, so we need to add it with: semanage port -a -t http_port_t -p tcp 1500
 
Done.
http_port_t tcp 1500, 80, 81, 443, 488, 8008, 8009, 8443, 9000
 
Great results. Right. Test time. Re-enable SELinux with setenforce 1. Then try re-starting apache.
 
[root@BUSINESSPOWER ~]# setenforce 1
[root@BUSINESSPOWER ~]# sudo /etc/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: httpd: Could not reliably determine the server's fully qualified domain name, using 89.104.220.207 for ServerName
[ OK ]
[root@BUSINESSPOWER ~]#
 
That looks good :-) And the website is still there. I think you've cracked it!
 
Or well you have!
How can i thank you? :)
 
8:52 PM
You can read up on SELinux - it's quite a scary beast at first, but if you keep at it and use plenty of Google, you'll get it in the end. Do NOT ever listen to advice that tells you to switch it off permanently. But do switch it off temporarily like we did during investigations as it does cause a lot of issues.
 
I will i promiss you!
 
OK. Take care :-)
 
Mate
one last thing
 
Go on...
 
if you post some of it as an answer
i will accept it and you will get some points
thats the least i can do!
 
8:54 PM
I'll write something up. Thank you.
 
Also. Are you looking for freelance work?
 
If I had the spare time maybe, but I don't. Ask good questions here and on Unix & Linux and there are plenty of people who will help out.
 
:) thank you
 

last day (15 days later) »