LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Server (https://www.linuxquestions.org/questions/linux-server-73/)
-   -   apache bad request (https://www.linuxquestions.org/questions/linux-server-73/apache-bad-request-746944/)

qwertyjjj 08-12-2009 04:46 AM
apache bad request
 
Not sure what's up but since this morning, I have started receving this on my server when requesting pages:
Bad Request

Your browser sent a request that this server could not understand.
Apache/2.2.3 (FH) Server at 88.xxx.xxx.xxx Port 80

Any ideas what to check?
I was playing about with mod_security but it was already installed so then removed the line I added from httpd.conf.
Got to be something to do with that?

dlugasx 08-12-2009 05:15 AM
Quote:
Originally Posted by qwertyjjj (Post 3640227)
Not sure what's up but since this morning, I have started receving this on my server when requesting pages:
Bad Request

Your browser sent a request that this server could not understand.
Apache/2.2.3 (FH) Server at 88.xxx.xxx.xxx Port 80

Any ideas what to check?
I was playing about with mod_security but it was already installed so then removed the line I added from httpd.conf.
Got to be something to do with that?


Try this...

http://support.mozilla.com/tiki-view...0430&forumId=1

Should help.

qwertyjjj 08-12-2009 05:16 AM
Quote:
Originally Posted by dlugasx (Post 3640262)
No, it happens on all my browsers...

dlugasx 08-12-2009 05:23 AM
Quote:
Originally Posted by qwertyjjj (Post 3640264)
No, it happens on all my browsers...
I think You have installed some spyware on Your machine.

Is it linux ?


Try to clean Your pc using this tool.

http://www.safer-networking.org

qwertyjjj 08-12-2009 05:25 AM
Quote:
Originally Posted by dlugasx (Post 3640273)
I think You have installed some spyware on Your machine.

Is it linux ?


Try to clean Your pc using this tool.

http://www.safer-networking.org
No, it only happens when accessing this linux server's webpages.
All other sites work fine.

dlugasx 08-12-2009 05:30 AM
Quote:
Originally Posted by qwertyjjj (Post 3640274)
No, it only happens when accessing this linux server's webpages.
All other sites work fine.
What kind of application is installed on that server ?


PHP, perl, html etc.etc ?

qwertyjjj 08-12-2009 05:32 AM
Quote:
Originally Posted by dlugasx (Post 3640282)
What kind of application is installed on that server ?


PHP, perl, html etc.etc ?
perl but the specific pages I'm requesting are only html pages

qwertyjjj 08-12-2009 05:54 AM
error-Log gives:

[Wed Aug 12 11:36:15 2009] [error] [client 86.1xxx.xxx.xxx] ModSecurity: Access denied with code 400 (phase 2). Pattern match "^[\\d\\.]+$" at REQUEST_HEADERS:Host. [file "/etc/httpd/modsecurity.d/modsecurity_crs_21_protocol_anomalies.conf"] [line "60"] [id "960017"] [msg "Host header is a numeric IP address"] [severity "CRITICAL"] [tag "PROTOCOL_VIOLATION/IP_HOST"] [hostname "88.xxx.xxx.xxx"] [uri "/favicon.ico"] [unique_id "Y376mX8AAAEAAASzGQAAAAAD"]

I commented out that line in the modsecurity but I'm not sure how it could have got added.
I installed a new modsecurity today, latest from their site but I didn't actually change any config files.

dlugasx 08-12-2009 07:00 AM
Quote:
Originally Posted by qwertyjjj (Post 3640307)
error-Log gives:

[Wed Aug 12 11:36:15 2009] [error] [client 86.1xxx.xxx.xxx] ModSecurity: Access denied with code 400 (phase 2). Pattern match "^[\\d\\.]+$" at REQUEST_HEADERS:Host. [file "/etc/httpd/modsecurity.d/modsecurity_crs_21_protocol_anomalies.conf"] [line "60"] [id "960017"] [msg "Host header is a numeric IP address"] [severity "CRITICAL"] [tag "PROTOCOL_VIOLATION/IP_HOST"] [hostname "88.xxx.xxx.xxx"] [uri "/favicon.ico"] [unique_id "Y376mX8AAAEAAASzGQAAAAAD"]

I commented out that line in the modsecurity but I'm not sure how it could have got added.
I installed a new modsecurity today, latest from their site but I didn't actually change any config files.

with mod_security You have to be very carefull.

Each rule should be tested before You will put it to production.

If Your url is recognized like a risk of attack maybe You have to create the rule which will accept this link.


Also dont forget to observe robots on Your website. Default configuration of the mod_security close access for many webcrawlers (also for google, yahoo).

qwertyjjj 08-12-2009 07:03 AM
Quote:
Originally Posted by dlugasx (Post 3640365)
with mod_security You have to be very carefull.

Each rule should be tested before You will put it to production.

If Your url is recognized like a risk of attack maybe You have to create the rule which will accept this link.


Also dont forget to observe robots on Your website. Default configuration of the mod_security close access for many webcrawlers (also for google, yahoo).
Is there something that can monitor mod_security logs so you know what's going on?


All times are GMT -5. The time now is 07:12 PM.