http: testing track / trace

been disabling track / trace on my web servers for security purposes without knowing how to check if it is really disabled. now i found a procedure to verify if track / trace is disabled.

# telnet <ip> 80

you can use other ports. i use the usual port 80 for http

then enter the ff:

TRACK / HTTP/1.0
Host: <ip>
TestA: H
TestB: W

and / or:

TRACE / HTTP/1.0
Host: <ip>
TestA: H
TestB: W


then press enter until an output is displayed.

if track / trace is enabled, you'll see the server info.

(src. http://www.techstacks.com/howto/disable-tracetrack-in-apache-httpd.html)

linux: apache 2.4.6 apr not found

got apr not found when compiling apache 2.4.6

to fix:

download apr and apr-util from http://apr.apache.org/
extract apr and apr-util and place in ./scrlib/apr and ./scrlib/apr-util respectively

configure http with --with-included-apr

(http://stackoverflow.com/questions/9436860/apache-httpd-setup-and-installation)

apache: define multiple domain over http & https

to define multiple domain, make sure you include NameVirtualHost setting and <VirtualHost> entries in your apache configuration file.

i got the ff warning messages when i forgot to include these settings:
[] [warn] VirtualHost 127.0.0.1:443 overlaps with VirtualHost 127.0.0.1:443, the first has precedence, perhaps you need a NameVirtualHost directive
[] [warn] _default_ VirtualHost overlap on port 443, the first has precedence


here's what i have in my apache configuration file for multiple domain handling over http and https:
# this is important to handle different domains and ports
NameVirtualHost *:80
NameVirtualHost *:443

<VirtualHost *:80>
        ServerName mydomain1.ph
        ServerAlias www.mydomain1.ph
        DocumentRoot /usr/local/apache2/htdocs/
</VirtualHost>

<VirtualHost *:80>
        ServerName mydomain2.ph
        ServerAlias www.mydomain2.ph
        DocumentRoot /usr/local/apache2/htdocs/mydomain2
</VirtualHost>





<VirtualHost *:443>

        ServerName mydomain1.ph

        ServerAlias www.mydomain1.ph

        DocumentRoot /usr/local/apache2/htdocs/

        SSLEngine  on

        SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server.crt

        SSLCertificateKeyFile /usr/local/apache2/conf/ssl.key/server.key

</VirtualHost>




<VirtualHost *:443>

        ServerName mydomain1.ph

        ServerAlias www.mydomain2.ph

        DocumentRoot /usr/local/apache2/htdocs/mydomain2

        SSLEngine  on

        SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server.crt

        SSLCertificateKeyFile /usr/local/apache2/conf/ssl.key/server.key

</VirtualHost>

http: couple of ways to forward http requests

if you have a domain name that points to an ip and you want to serve another page...

if hosted on a different machine which also has a public ip, you can easily redirect requests by javascript's window.location
ex.
<script language="JavaScript">window.location="http://x.x.x.x";</script>

or encapsulate the page in an html frame
ex.
<frameset frameborder="NO" cols="100%,*" rows="*" border="0" framespacing="0">
                <frame name="topFrame" scrolling="auto" src="http://x.x.x.x" />
</frameset>

if hosted on a different machine which has no public ip, you can do port forwarding using your firewall
ex.
in iptables forwarding public ip x.x.x.x port 81 to local ip y.y.y.y port 80:
-A PREROUTING -d x.x.x.x -p tcp --dport 81 -j DNAT --to y.y.y.y:80
-A POSTROUTING -d y.y.y.y -p tcp --dport 80 -j SNAT --to x.x.x.x:81

or if you want to serve another domain on the same machine, you can use apache's virtual host
ex.
NameVirtualHost *:80
<VirtualHost *:80>
        ServerName alternate.mydomain.ph
        DocumentRoot /usr/local/apache2/htdocs/alternate
</VirtualHost>