Chef Apache2 recipe on RHEL: ServerName not defined in the default recipe - apache

I am using Chef to build out a virtual machine on Rackspace. The VM is a RHEL 6.5 box.
I am running into problems building the default Apache2 /etc/httpd/conf/httpd.conf file cleanly for RHEL using the Apache2 recipe (it appears to default to an Ubuntu flavor configuration).
In the recipe config template (apache2/templates/default/apache2.conf.erb) there is no place to define ServerName. Consequently when I test Apache is working properly I get the following
% apachectl configtest
httpd: Could not reliably determine the server's fully qualified domain name, using ##### for ServerName
Syntax OK
where ##### is my DNS, listed in my /etc/hosts and defined in my cookbook recipe attributes/default.rb file as servername.
If I look in the recipe template I don't see any location for the variable ServerName (first 17 lines):
#
# Generated by Chef
#
# Based on the Ubuntu apache2.conf
ServerRoot "<%= node['apache']['dir'] %>"
#
# The accept serialization lock file MUST BE STORED ON A LOCAL DISK.
#
<% if %w[debian].include?(node['platform_family']) -%>
LockFile /var/lock/apache2/accept.lock
<% elsif %w[freebsd].include?(node['platform_family']) -%>
LockFile /var/log/accept.lock
<% else %>
LockFile logs/accept.lock
<% end -%>
Now, if I manually go and edit /etc/httpd/conf/httpd.conf, adding a ServerName variable, everything works. Relevant before and after below:
BEFORE
#
# Generated by Chef
#
# Based on the Ubuntu apache2.conf
ServerRoot "/etc/httpd"
AFTER
#
# Generated by Chef
#
# Based on the Ubuntu apache2.conf
ServerRoot "/etc/httpd"
ServerName #####:80
Now when I test Apache:
% apachectl configtest
Syntax OK
Obviously the whole point of using Chef is to not hand edit configuration files, and whenever I rerun my chef recipe with chef-solo I am going to blow this customization away. I am so new to Chef that I don't really want to fork the cookbook on Github and make a new template for RHEL, but maybe that's what I need to do?
I am hoping there is just one configuration setting in my overall recipe I am not defining, that will add this variable to my core Apache httpd.conf file.
Hopefully someone with more experience with Chef, and in particular the Apache2 cookbook, can help me. Thanks in advance.
EDIT #1
A look at netstat -tulpn shows that I think Apache (httpd) is actually working, or at least listening in on port 80:
% netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1274/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1677/master
tcp 0 0 **.***.*.***:3306 0.0.0.0:* LISTEN 1585/mysqld
tcp 0 0 :::80 :::* LISTEN 6663/httpd
tcp 0 0 :::22 :::* LISTEN 1274/sshd
tcp 0 0 ::1:25 :::* LISTEN 1677/master
Is it looking more and more like a networking (DNS) issue?
EDIT #2
Based on the helpful comments to my original post I think I originally misdiagnosed this. I just built a new Ubuntu VM and installed Apache2 by hand using sudo apt-get install apache2 (ie. not using chef-solo) and I see the same installed layout of apache2 that my Chef recipe created on my RHEL VM. I also get the same warning when running apachectl configtest:
apache2: Could not reliably determine the server's fully qualified domain name, using ##### for ServerName
Syntax OK
When I point the browser on Ubuntu to 127.0.0.1:80 I see the 'It works!' standard Apache response. So, my issue is not really an issue. My thinking now is that this is a network problem. iptables?
EDIT #3
I just ssh'd into my RHEL VM and installed Firefox. I then opened it up and pointed it to 127.0.0.1:80 and I get the default page. I think this categorically confirms that I have a DNS issue. Time to speak to my networking admin.

As per the helpful comments from users cassianoleal and StephenKing, this "error" was actually a red herring. It is just an Apache warning that has no effect on if httpd is actually running or not.
The problem was really that I wasn't updating my iptables config. Once I installed the Chef cookbook simple_iptables and added a simple_iptables_rule to my Chef recipe to update my iptables to listen on ports 80 and 443, everything worked.
Live and learn I guess.
For the record, Chef is highly recommended if you aren't using it yet!

Related

Apache version conflict (cont)

Concerning the post Apache versions conflict. I tried again the installation of apache following the steps from https://getgrav.org/blog/macos-sierra-apache-multiple-php-versions
I still have some problems if I want to test localhost from my local Site folder.
Result of apache log
Regarding the error
Could not reliably determine the server's fully qualified domain name,
using 127.0.0.1. Set the 'ServerName'...
I tried the option of adding ServerName localhost in the file /etc/apache2/apache2.conf https://askubuntu.com/questions/454497/apache2-could-not-reliably-determine-the-servers-fully-qualified-domain-name but I don't know if that is that is the right file, because i'm working with apache 2.4 (/usr/local/etc/apache2/2.4/httpd.conf)
Additionally, if I run the command sudo apachectl -k restart I got this
(48)Address already in use: AH00072: make_sock: could not bind to address [::]:80
(48)Address already in use: AH00072: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
In my file /etc/apache2/httpd.conf
I have this:
# Change this to Listen on specific IP addresses as shown below to
# prevent Apache from glomming onto all bound IP addresses.
#
#Listen 12.34.56.78:80
Listen 80
# User/Group: The name (or #number) of the user/group to run httpd as.
# It is usually good practice to create a dedicated user and group for
# running httpd, as with most system services.
#
User amhg
Group staff
# ServerName gives the name and port that the server uses to identify itself.
# This can often be determined automatically, but we recommend you specify
# it explicitly to prevent problems during startup.
#
# If your host doesn't have a registered DNS name, enter its IP address here.
#
ServerName localhost
DocumentRoot /Users/amhg/Sites
<Directory /Users/amhg/Sites>
#
AllowOverride All
and I uncommented LoadModule rewrite_module libexec/mod_rewrite.so
Any suggestions?
Thank you in advance!
you can see all of your apache installed version with command :
rpm -qa | grep httpd
in your log file I do not see any error.
can you sent all of your log file?
and can you explain what do you see in browser when go to :
http://localhost

Is it possible to run 2 servers with seperate SSL certificates on 1 IP address?

I have two domains running on separate local servers, each with their own SSL certificate. In the past, this would require two public IP addresses. With the advent of SNI (Server Name Indication), these two sites can be run on the same server by modifying Apache.conf like so-
<NameVirtualHost *:443>
<VirtualHost *:443>
ServerName www.yoursite.com
DocumentRoot /var/www/site
SSLEngine on
SSLCertificateFile /path/to/www_yoursite_com.crt
SSLCertificateKeyFile /path/to/www_yoursite_com.key
SSLCertificateChainFile /path/to/DigiCertCA.crt
</VirtualHost>
<VirtualHost *:443>
ServerName www.yoursite2.com
DocumentRoot /var/www/site2
SSLEngine on
SSLCertificateFile /path/to/www_yoursite2_com.crt
SSLCertificateKeyFile /path/to/www_yoursite2_com.key
SSLCertificateChainFile /path/to/DigiCertCA.crt
</VirtualHost>
Due to security concerns, I would prefer to run these sites on different local servers to help mitigate damages in case one server is compromised.
Can this be done via a local IP address redirect in Apache.conf without breaking the SSL certificate?
Thank you in advance for any suggestions.
Since you're happy to use SNI, your problem here isn't so much about using two certificates on the same IP address (and port), it's about having two servers bound to the same IP address and port at the same time.
Having two distinct servers listening on the same IP address and port is generally not possible or useful (depending on the OS).1
That said, nothing prevents you from running other Apache Httpd instances, even on the same machine, listening on different ports.
To make the client connection still use port 443, you could have a main Apache Httpd server running and listening on that port, configured as a reverse proxy for the other server(s), depending on which VirtualHost is reached.
In this case, that front-end would still handle both certificates (and you would only generally require plain HTTP connection between the reverse proxy front-end and the other servers on the same host, although you might want to make sure the other hosts are only accessible from localhost).
Alternatively, I've seen (not tried) tools like sniproxy which allow you to detect the host name in the SNI extension and redirect this to other sockets. It's a similar principle, but each back-end server would handle its own certificate.
1. You may find people mentioning using SO_REUSEADDR on the socket, but that doesn't really solve the problem: it won't allow you to bind another process if another one is in LISTEN state on Unix ("This socket option tells the kernel that even if this port is busy (in the TIME_WAIT state), go ahead and reuse it anyway. If it is busy, but with another state, you will still get an address already in use error."), and it won't guarantee the connection will go to the right socket on Windows ("For example, if all of the sockets on the same port provide TCP service, any incoming TCP connection requests over the port cannot be guaranteed to be handled by the correct socket — the behavior is non-deterministic").
sniproxy suggestion from Bruno works like a charm! Very easy to install and configure.
Installed Ubuntu Server 14.04 64-bit.
Configured server (upgrades, ufw, etc.).
Installed git.
sudo apt-get install git
Installed sniproxy dependencies.
sudo apt-get install autotools-dev cdbs debhelper dh-autoreconf dpkg-dev gettext libev-dev libpcre3-dev libudns-dev pkg-config
Downloaded sniproxy 0.4.0 git files to desired folder.
git clone https://github.com/dlundquist/sniproxy.git
Built Debian package.
./autogen.sh && dpkg-buildpackage
Installed package.
sudo dpkg -i ../sniproxy__.deb
Edited /etc/sniproxy.conf "http_hosts" and "https_hosts" tables to point domains to the desired local ip addresses and ports.
Started sniproxy.
Usage: sniproxy [-c ] [-f] [-n ] [-V]
-c configuration file, defaults to /etc/sniproxy.conf
-f run in foreground, do not drop privileges
-n specify file descriptor limit
-V print the version of SNIProxy and exit
More instructions can be found at the sniproxy GitHub.

how to create multiple ports for apache on amazon EC2?

I have Ubuntu 32 bit AMI(amazon machine image) on amazon cloud.
I have installed the LAMP stack on it.
apache: 2.4.7
mysql: 5.5.38
php: 5.5.9
Above are specification for A-M-P
Then I got the one public IP address.(x.x.x.x)
Now I need to create the multiple ports.
LIKE
x.x.x.x:81
x.x.x.x:82
is it possible??
I have done some steps for the ports configuration as follows:
vim /etc/apache2/ports.conf ==> add line Listen 81
in virtual host file
<VirtualHost *:81>
-------
</VirtualHost>
vim /etc/apache2/hosts ==> added line 127.0.0.1 vhost_name
sudo a2ensite vhost_file_name.conf
sudo /etc/init.d/apache2 restart
Follow these instructions:
EC2 Instance
Update Apache
File: /etc/apache2/ports.conf
Listen 80
Listen 81
Listen xx where xx is a valid port number
Add/Update Virtual Host
Create a virtual host that listens to 81 or the port number that Apache is listening to.
Enable the site with sudo a2ensite name of the conf without .conf
Restart the apache sudo service apache2 restart
Amazon Console
Find the security group of the instance on the instances list.
Go to Security Group (find it on the LHS meun) and add the rules to allow the external world to talk to the port numbers your apache is listening to. Please follow this link to add the rules.

How do I configure apache2 to a port other than port 80?

I have installed apache2 on ubunto and have messed around with the text on the localhost page. Now I'm being asked to show it running on a port other than port 80. How do I do that?
You should change the line Listen x in your httpd.conf where x is the port number. You'll need to restart your apache server after that.
In the file: /etc/apache2/httpd.conf
change the following line:
Listen 80
to:
Listen <NEWPORT>
After that you need to restart the apache server:
sudo service apache2 start
UPDATE: Looks like with Ubuntu, the default /etc/apache2/httpd.conf is empty and the recommended approach is to create a new .conf file under /etc/apache2/conf.d so that even with software updates, the user changes are persistent.
So just create a new file say /etc/apache2/conf.d/mycustomizations.conf
Listen <NEWPORT>

Ubuntu error with apache: (98)Address already in use

I am getting this error when I try to start Apache in Ubuntu.
(98)Address already in use: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs
Action 'start' failed.
I have this in my ports.conf
NameVirtualHost *:80
Listen 80
This is my vhost file
<VirtualHost *:80>
ServerAdmin example#example.com
ServerName rails.server.com
# ServerAlias
DocumentRoot /var/www/sample_app/current/public
ErrorLog /var/www/sample_app/error.log
RailsEnv production
<Directory "/var/www/sample_app/current/public">
Options Indexes FollowSymLinks MultiViews
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
What am I missing?
netstat -ltnp | grep :80
This would return the following:
tcp6 0 0 :::80 :::* LISTEN 1047/apache2
Then run the following command:
sudo kill -9 1047
(1047 - pid no)
(the pid that appears on your particular instance.)
Restart Apache.
sudo service apache2 restart
Reference to Ubuntu Forums.
It seems port 80 is already taken. Use another port or try netstat (grep the result to select only the row with value 80 in it), ps and kill to see what application occupies the port and shut it down.
In all cases killing the process may not work, as the process using the port 80 will get restarted and doesn't allow to use the port. So what can be done is to change the port for apache, if that doesn't matter.
Two things are to be changed for that:
Open /etc/apache2/ports.conf with any text editor and change the value of the entry Listen 80 to the desired port (e.g. Listen 8080).
Change the entry for <virtualhost 80> to the same port number you gave in the /etc/apache2/ports.conf file in /etc/apache2/sites-enabled/000-default (e.g. <virtualhost 8080>).
Make sure that you don't have the command Listen 80 in more than one place.
In my case, I was getting the same error and the reason was that this command was both in ports.conf and sites-enabled/000-default.
In my case it was nginx ('cause I have it on my server).
sudo service nginx stop
sudo service apache2 start
sudo netstat -tulpn| grep :80
pkill the process (nginx?)
Disable whatever virtualhost is binding to port 80 that you don't want to (nginx?). It's in /etc/nginx/sites-enabled or /etc/apache2/sites-enabled
sudo kill -9 -2321 (pid)
Restart BT
Done.....
no need to make changes in conf. file.
This is due to port 80 is shifted used by other service.
sudo killall httpd
Check any service is using 80 still
sudo netstat -tulpn| grep :80
and restart the server
sudo service httpd start
When you restart or start your server via terminal you might have forgot to add sudo before the command.
Use sudo /etc/init.d/apache2 reload instead of /etc/init.d/apache2 reload
I had the same issue with a very different cause. I am running Apache 2.4.7 with PHP 5.5.6 on CentOS 6.5.
I messed up php.ini by having BOTH output_handler=ob_gzhandler AND zlib.output_compression=On (either one, not both, can be set).
So on restarting Apache, it binds to port 80 but nothing else happens. It looks like it is running but php's error locked it up somewhere.
The clue was to check "php -v" ... when I saw it not returning anything (it wrote the error to error_log), I fixed php.ini and Apache was happy again.
Maybe this helps someone...
I got this error on a fresh install of Ubuntu 12.10 when starting apache2.
It's a bug in the apache2. It gets hung in the background. Here is my walkthrough to where the bugs might be in the software.
Here's the error I got:
el#titan:~$ sudo service apache2 start
* Starting web server apache2
(98)Address already in use: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs
Action 'start' failed.
The Apache error log may have more information.
[fail]
Address already in Use? What could be using it? Check it out:
el#titan:~$ grep -ri listen /etc/apache2
/etc/apache2/apache2.conf:# supposed to determine listening ports for incoming connections, and which
/etc/apache2/apache2.conf:# Include list of ports to listen on and which to use for name based vhosts
/etc/apache2/ports.conf:Listen 80
/etc/apache2/ports.conf: Listen 443
/etc/apache2/ports.conf: Listen 443
That means apache2 is preventing apache2 from starting. Bizarre. This will confirm:
el#titan:~$ ps -ef | grep apache2
root 1146 954 0 15:51 ? 00:00:00 /bin/sh /etc/rc2.d/S91apache2 start
root 1172 1146 0 15:51 ? 00:00:00 /bin/sh /usr/sbin/apache2ctl start
root 1181 1172 0 15:51 ? 00:00:00 /usr/sbin/apache2 -k start
root 1193 1181 0 15:51 ? 00:00:00 /bin/bash /usr/share/apache2/ask-for-passphrase 127.0.1.1:443 RSA
el 5439 5326 0 16:23 pts/2 00:00:00 grep --color=auto apache2
Yes, in this case apache2 is running, I was trying to start apache2 a second time on the same port.
What confuses me is that service reports that apache2 is NOT running:
el#titan:~$ sudo service apache2 status
Apache2 is NOT running.
And when you query apache2ctl for its status, it hangs.
root#titan:~# /usr/sbin/apache2ctl status
**hangs until Ctrl-C is pressed.
So Ubuntu seems to be having trouble managing apache2 on bootup. Time to stop apache2:
root#titan:~# /usr/sbin/apache2ctl stop
httpd (no pid file) not running
A big clue! You try to stop apache2 and it lost the process id! So Ubuntu can't stop apache2 because it doesn't know where it is!
You would think a reboot would fix it, but it doesn't because apache2 starts on boot and hangs. The normal boot process for apache2 is not working right.
So How to fix it?
I was able to fix this by analyzing the ps command output. Notice that the ps command tells us that that process was started by "/etc/rc2.d/S91apache2 start".
That is the offending program that needs a swift kick.
/etc/rc2.d/S91apache2 is the symbolic link used to start apache2 for you when the computer starts. For some reason it seems to be starting apache2 and then hangs. So we'll have to tell it to not do that.
So go take a look at that /etc/rc2.d/S91apache2.
el#titan:/etc/rc2.d$ ls -l
lrwxrwxrwx 1 root root 17 Nov 7 21:45 S91apache2 -> ../init.d/apache2*
It's a symbolic link that we don't want it to be there. Do this to prevent apache2 from starting on boot:
root#titan:~# sudo update-rc.d -f apache2 remove
Removing any system startup links for /etc/init.d/apache2 ...
/etc/rc0.d/K09apache2
/etc/rc1.d/K09apache2
/etc/rc2.d/S91apache2
/etc/rc3.d/S91apache2
/etc/rc4.d/S91apache2
/etc/rc5.d/S91apache2
/etc/rc6.d/K09apache2
Reboot the computer to make sure apache2 doesn't start and hang. Ok good. Now you COULD put apache2 back the way it was, but that would make it fail again.
root#titan:~$ sudo update-rc.d apache2 defaults //(don't do this)
Adding system startup for /etc/init.d/apache2 ...
/etc/rc0.d/K20apache2 -> ../init.d/apache2
/etc/rc1.d/K20apache2 -> ../init.d/apache2
/etc/rc6.d/K20apache2 -> ../init.d/apache2
/etc/rc2.d/S20apache2 -> ../init.d/apache2
/etc/rc3.d/S20apache2 -> ../init.d/apache2
/etc/rc4.d/S20apache2 -> ../init.d/apache2
/etc/rc5.d/S20apache2 -> ../init.d/apache2
Instead, start the apache2 like this:
sudo service apache2 start
And the apache2 is back up and serving pages again. There seems to be some serious bugs with apache2/Ubuntu 12.10 that causes apache2 to start and hang. This is a workaround, I suppose the fix is to get newer versions of apache2 and Ubuntu and hope for the best.
In my case, I had removed the default ssl.conf file (renamed to ssl.conf.bak), and had my own ssl config file.
Then I did a yum update and it updated apache... Which also reintroduced the file ssl.conf, which means how I had 2 conf files with Listen 443.
Solution (generic - CentOS): go to /etc/httpd/conf.d, do a grep -r 'Listen' ., see if you have duplicate Listen XXX statements, remove them as required.
List of currently running services,
$ sudo netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:8069 0.0.0.0:* LISTEN 6399/python
tcp 0 0 0.0.0.0:53670 0.0.0.0:* LISTEN 6681/Brackets-node
....
....
Find only specific services,
$ sudo netstat -tulpn| grep python
jpa#jpa-dell:~/odoo/master-hr-holidays-newapi-jpa$ sudo netstat -tulpn| grep python
tcp 0 0 0.0.0.0:8069 0.0.0.0:* LISTEN 6399/python
tcp 0 0 127.0.0.1:41974 0.0.0.0:* LISTEN 3123/python
Did you notice above result PID (6399) running python.
Kill that service using following command,
$ sudo kill -9 -6399
Now services is completely stop, you can start again normally.
Extra command for finding running srrvices,
$ ps -ef
$ ps -ef | grep python
Except the solution find process running on :80 and kill, then start again,
This error might have if you have multiple "Listen" entries in apache conf file or in any .conf files Included in apache conf file. Hope this helps to someone..!!
Try these commands:
Stop and then restart service.
sudo service apache2 stop sudo service apache2 restart