platform Rewrite rules break other apache Location directives. [#600900]

I have a conf file in /etc/apache2/mods-enabled/ which provides a Location directive for mod_status. (ie. so that http://localhost/server-status will get passed to mod_status, even though it doen't exist anywhere in the file system.

It looks like this.

<IfModule mod_status.c>
<Location /server-status>
    SetHandler server-status
    Order deny,allow
    Deny from all
    Allow from localhost ip6-localhost
</Location>
</IfModule>

The platform_xxx.conf files are breaking my Locations, through their application of rewrite rules. I tested this by disabling the Aegir vhost directory completely, and I just copied the a platform_xxx and main-aegir-site.com_80 files and placed them straight into conf.d.

The problem still happened, then I commented out the rewrite rules in the platform_xxx.conf and the problem went away.

A solution I found suggests to place an except in the .htaccess file.

RewriteCond %{REQUEST_URI} !=/server-status

So if this was just Drupal I could do this, case by case. But for Aegir, what we need is a way to generically prevent this from happening, even if it's something along the lines of "If you have this problem, edit your httpd.conf..." .

I'm still investigating a solution.

Comments

Comment #1

sime CreditAttribution: sime commented 10 October 2009 at 14:24

So it's an order problem. In apache2.conf in order of appearance:

Include /etc/apache2/mods-enabled/*.load
Include /etc/apache2/mods-enabled/*.conf  <-- Location directive here.
Include /etc/apache2/httpd.conf
Include /etc/apache2/ports.conf
Include /etc/apache2/conf.d/    <-- My aegir is happening here.
Include /etc/apache2/sites-enabled/

I need some thoughts on how much to mess with these orders. I'm going to start with moving the mod_status files to sites-enabled, even though they were placed there by apt-get install I think...

Comment #2

sime CreditAttribution: sime commented 10 October 2009 at 14:35

OK, buzz. It will only work if I move the Aegir vhosts loading to BEFORE the mods LOAD. So I can't just move the .conf definitions around (ie. the Location directives), I have to mess with all the .so loading orders.

I can probably find a solution that works for me, but this is going to bite again in the future, methinks.

Comment #3

sime CreditAttribution: sime commented 10 October 2009 at 15:04

Just to cap up the bug report. My Location directive doesn't change if I move conf.d BEFORE my mod_rewrite.so -- but, not surprisingly, this means the directives aren't running for Drupal! So it's not a solution.

Comment #4

sime CreditAttribution: sime commented 10 October 2009 at 15:12

After the modules loading section, I tried adding this server-wide, to apache2.conf to exclude "server-status" as being allowed for re-write.

<IfModule mod_rewrite.c>
  RewriteEngine on
  RewriteCond %{REQUEST_URI} !=/server-status
</IfModule>

No luck, I think it might need to have a container.

Comment #5

jonhattan

Spanish

Plasencia

CreditAttribution: jonhattan commented 11 October 2009 at 12:07

It does happen with Location but not with Alias. As an example phpmyadmin does not conflict. I tried and did a non-beauty but effective test:

Alias /server-status /dev/null
<Location /server-status>
    SetHandler server-status
    Order Allow,Deny
    Allow from all
</Location>

yes... "It works!" :p

btw, I use to put custom server-side directives (server-status, rewrite to https for /webmail,...) in `conf.d/server.conf` instead of messing `mods-enabled/*` or `apache2.conf`. It goes smooth on apache2 upgrades.

Comment #6

anarcat CreditAttribution: anarcat commented 13 October 2009 at 21:55

This is a real issue: we should be careful with this. Furthermore, rewrite rules should apply only to a vhost or at least a directory...

Comment #7

sime CreditAttribution: sime commented 21 October 2009 at 12:02

I got my particular case working.

<IfModule mod_status.c>
  <Location /server-status>
      # Explicitly turn off rewrites if we match /server-status
      RewriteEngine off
      SetHandler server-status
      Order deny,allow
      Deny from all
      Allow from localhost ip6-localhost
  </Location>
</IfModule>

But I confirmed that this means you can't use those paths on any hosted site (you get "403 Forbidden" for correctly configured mod_watch etc).

However, I assume this is pretty normal, it is no different to behavior we see with /phpmyadmin (etc). For what it's worth, for future googlers, here are the paths that I'm implemented to get munin vhost stats working.
/server-status
/watch-info
/watch-table
/watch-list
/server-info

I assume this can be closed, would it just be a documentation issue?