This is how you change the password.

We got it. Had to open the Nginx logs and noticed too many "posts" in the error log. Dug in and it was three ranges overseas all hitting with a "post timeout attack." It was a light DDoS where sessions were being opened and held causing nginx to wait on a timeout. This caused Apache to just increment forever. Once we blocked those ranges, the Apache thread count started to drop for the first time, and memory started to release. And the continuous flood of nginx error logs ceased.

If you are looking at nginx error logs, this is what you look for: upstream timed out (110: Connection timed out) while reading response header from upstream, client:

You can use this command to collect the offending IP addresses:

grep "upstream timed out" error.log | cut -d' ' -f20

Then use your firewall to shut them down. We are all good now! Woot.

Worth noting that the issue comes back when you upgrade to Fedora 31 as well. Same fix still applies.

@dafyre said in Fedora 29 Apache HTTPD Keeps Adding ssl.conf:

Have you tried creating a blank ssl.conf file and then chmod +i ssl.conf ?

I've not, but that's such a hockie way of doing it, I was hoping not to.

@coliver said in CentOS7 Server Apache Disable old TLS for higher versions:

@jaredbusch said in CentOS7 Server Apache Disable old TLS for higher versions:

@coliver said in CentOS7 Server Apache Disable old TLS for higher versions:

@DustinB3403 I really like this site for information on securing various web servers.

https://cipherli.st/

I just implemented their Nginx setting but getting back that TLSv1 was accepted?

https://www.ssllabs.com/ssltest/analyze.html?d=naggaroth.daerma.com

First line should read TLS1.2 if you don't have a version of Nginx that supports 1.3.

Correct. That is the only change I made to their config. I even reran dhparam

@jaredbusch said in HTTPD Fails To Start On Reboot Fedora:

@nashbrydges said in HTTPD Fails To Start On Reboot Fedora:

@black3dynamite said in HTTPD Fails To Start On Reboot Fedora:

Was bookstack working before the reboot?

It was working. Only after reboot did it screw up.

@black3dynamite he probably has not rebooted since the first install which he did prior to me fixing the log file error.

Yup. You are correct.

@jaredbusch said in Apache Struts - Critical Security Flaw:

Was the Eqifax breech because of the march strus flaw or a more recent one?

Just making sure the actual facts are known.

The one from March.

@scottalanmiller How are you liking Salt Stack?

@scottalanmiller Also, using just using the root domain name for the conf file name is potentially confusing depending on how much you are hosting.

Even for my gaming website, I have a bunch of sub domains setup.

www.daerma.com.conf goes to the root and www.
oc.daerma.com.conf is owncloud
obelisk.daerma.com.conf is my nodeBB forum

That does not even get into what do you do about the ones that you have multiple TLD names for such as .it, .com, .org, etc.

@scottalanmiller said in Installing a Basic LAMP Stack on CentOS 7:

@NashBrydges said in Installing a Basic LAMP Stack on CentOS 7:

@scottalanmiller I haven't yet. About to give it a try. Stuck to legacy since that was what I was reading everywhere.

Where is everywhere? Technet says to not use legacy.

https://technet.microsoft.com/en-us/windows-server-docs/compute/hyper-v/supported-centos-and-red-hat-enterprise-linux-virtual-machines-on-hyper-v

Legacy is a fallback driver that you never want to use, it's low performance and high overhead. If you needed that for CentOS, it would make Hyper-V a silly, non-production ready platform. But Hyper-V is a good, solid performer.

Not only that, but I install all of my CentOS 7 VM's as Generation 2 when on Hyper-V they work perfectly with default settings for everything except secure boot. Uncheck secure boot. Everything else is 100% default settings.

@scottalanmiller said in Elastix login page gives error HTTP ERROR 500 when login:

@dbeato said in Elastix login page gives error HTTP ERROR 500 when login:

@denny said in Elastix login page gives error HTTP ERROR 500 when login:

systemctl stop firewalld disable selinux find /var/www/html/var/ -type d -exec chmod 755 {} ; find /var/www/html/var/ -type f -exec chmod 755 {} ;

🙂

Way to necro a post, security and firewall ar of the upmost importance. No system ever needs to be setup open this way....

I think that he was being tongue in cheek.

Okay, I didn't get it LOL

@scottalanmiller said in ownCloud 8.2.4 to 9.0.2 upgrade problem:

have you tested yet?

I have more systems that I can upgrade, but I have not done so yet.

@scottalanmiller said:

Nothing scarier than things that fix themselves 😞

Seriously upset about this. I will be rebooting the machine a few times today trying to make it do it again.