[OT] Apache error log

[Alexander Dewilde]

Dear list,

I found a strange issue in the Apache2 log.
The lasso site uses some include files which are in a separate  
directory and http access is denied in apache conf file.

/webroot/default.lasso
/webroot/inc-files/ ..............

where default.lasso includes some files from the latter and
/webroot/inc-files/ is configuerd 'deny from all' in apache conf file

All is fine except the apache error log shows 'client denied by server  
configuration' always 2 times for each called include.
The site runs ok though and this issue does not seem to affect  
performance, but it's something to look at, because as I  
understand .lasso files are handed over to lasso and are not handled  
by apache in any way except for returning lasso output to the client.  
Seems like apache is doing more than it should?

Thanks for any insight on this...

OSX box 10.4
Apache 2.23
LP8.55

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Jason Huck]

Unfortunately that's normal. Lasso uses Apache to retrieve the include
files. The only real downside is that it clutters up your logs. One
solution is to raise the LogLevel in Apache, though that may cause
other things not to be logged that you'd like to know about. There's
another solution using mod_rewrite that we found here on the list. Bil
had something to do with it IIRC. This would go in your Apache config,
and assumes you use an '.inc' extension for your include files:

# disallow direct serving of .inc files
# this method should avoid cluttering up apache's
# error logs with subrequests.
# -------------------------------------------------------------------
RewriteCond %{REQUEST_URI}  ^.*\.inc$  [NC]
RewriteRule (.*)  - [L,NS,F]


- jason









On Wed, Jul 8, 2009 at 10:17 AM, Alexander Dewilde<ad@...> wrote:

> Dear list,
>
> I found a strange issue in the Apache2 log.
> The lasso site uses some include files which are in a separate directory and
> http access is denied in apache conf file.
>
> /webroot/default.lasso
> /webroot/inc-files/ ..............
>
> where default.lasso includes some files from the latter and
> /webroot/inc-files/ is configuerd 'deny from all' in apache conf file
>
> All is fine except the apache error log shows 'client denied by server
> configuration' always 2 times for each called include.
> The site runs ok though and this issue does not seem to affect performance,
> but it's something to look at, because as I understand .lasso files are
> handed over to lasso and are not handled by apache in any way except for
> returning lasso output to the client. Seems like apache is doing more than
> it should?
>
> Thanks for any insight on this...
>
> OSX box 10.4
> Apache 2.23
> LP8.55
>
> --
> This list is a free service of LassoSoft: http://www.LassoSoft.com/
> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
> Manage your subscription: http://www.ListSearch.com/Lasso/
>
>
>

--
tagSwap.net :: Open Source Lasso Code
<http://tagSwap.net/>

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Alexander Dewilde]

Jason,

I'll give it a try...

One more thing: if lasso uses apache to retrieve files, and those  
files are in a protected directory 'deny from all', how can lasso get  
access to those files?

> Unfortunately that's normal. Lasso uses Apache to retrieve the include
> files. The only real downside is that it clutters up your logs. One
> solution is to raise the LogLevel in Apache, though that may cause
> other things not to be logged that you'd like to know about. There's
> another solution using mod_rewrite that we found here on the list. Bil
> had something to do with it IIRC. This would go in your Apache config,
> and assumes you use an '.inc' extension for your include files:
>
> # disallow direct serving of .inc files
> # this method should avoid cluttering up apache's
> # error logs with subrequests.
> # -------------------------------------------------------------------
> RewriteCond %{REQUEST_URI}  ^.*\.inc$  [NC]
> RewriteRule (.*)  - [L,NS,F]
>
>
> - jason

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[James Harvard]

FWIW I don't think this needs two rules. This should work just as well:

RewriteRule \.inc$ - [L,NS,NC,F]

At 10:25 -0400 8/7/09, Jason Huck wrote:
># disallow direct serving of .inc files
># this method should avoid cluttering up apache's
># error logs with subrequests.
># -------------------------------------------------------------------
>RewriteCond %{REQUEST_URI}  ^.*\.inc$  [NC]
>RewriteRule (.*)  - [L,NS,F]

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[bilcorry]

James Harvard wrote on 7/9/2009 6:01 AM:
> FWIW I don't think this needs two rules. This should work just as well:
>
> RewriteRule \.inc$ - [L,NS,NC,F]

Good catch.  I plan on revisiting my entire Apache conf once I move to Apache 2.2 with Lasso 9, so I'll be sure to change this at the same time.

Thanks,

- Bil



--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[bilcorry]

Alexander Dewilde wrote on 7/9/2009 4:43 AM:
> One more thing: if lasso uses apache to retrieve files, and those files
> are in a protected directory 'deny from all', how can lasso get access
> to those files?

I've never quite understood that either -- it may be that Lasso asks for the real path to the file given the URL, then retrieves the file based on the real path.  So if your rule prevents Apache from serving files with a URL path that contains /protected/, Lasso doesn't need the actual contents of the file, just the real hard disk path, and your rule doesn't cover internal file requests.

I have unintentionally prevented Lasso from retrieving files, but I don't recall now how.


- Bil


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/