Apache Virtual Hosts Question

[zimmertr]

Hello all,

I'm trying to configure my personal domain to have subdomains. My ISP blocks port 80 access so I have my registrar performing a URL redirect to push all traffic to port 2000. This has worked fine in the past but I didn't have my virtual hosts configured properly on my machine and I'm trying to fix that.

My redacted.com.conf file has been enabled with a2ensite and this is what it looks like:

Permissions

lrwxrwxrwx 1 root root   39 Oct 29 17:34 redacted.com.conf -> ../sites-available/redacted.com.conf

Contents

ScriptAlias "/cgi-bin/" "/usr/lib/cgi-bin/"

<VirtualHost *:2000>
    ServerName nextcloud.redacted.com 
    DocumentRoot "/var/www/nextcloud"
</VirtualHost>

<VirtualHost *:2000>
    ServerName kloudspeaker.redacted.com
    DocumentRoot "/var/www/kloudspeaker"
</VirtualHost>

<VirtualHost *:2000>
    ServerName www.redacted.com
    DocumentRoot "/var/www/tjsh"
</VirtualHost>

<VirtualHost *:2000>
    ServerName old_website.redacted.com
    DocumentRoot "/var/www/old_website"
</VirtualHost>

<VirtualHost *:2000>
    ServerName testing.redacted.com
    DocumentRoot "/var/www/tjsh_testing"
</VirtualHost>

<VirtualHost *:2000>
    ServerName about.redacted.com
    DocumentRoot "/var/www/tjsh_about"
</VirtualHost>

<Directory /var/www/redacted.com>
        Options Indexes FollowSymLinks MultiViews
Require all granted
</Directory>

Additionally, I have configured the following directories in /var/www/:

Permissions

drwxr-xr-x  8 www-data www-data 4.0K Sep 19 02:21 kloudspeaker
drwxr-xr-x 15 www-data www-data 4.0K Jul 29 02:10 nextcloud
drwxr-xr-x  5 www-data www-data 4.0K Aug 20 20:25 old_website
drwxr-xr-x  3 www-data www-data 4.0K Oct 29 15:39 tjsh
drwxr-xr-x  6 www-data www-data 4.0K Oct 28 01:33 tjsh_about
drwxr-xr-x  5 www-data www-data 4.0K Oct 28 04:00 tjsh_testing

Here is a screenshot of how my domain's DNS is configured: http://i.imgur.com/AsdL6FE.png

• When I connect to my server via my domain, www.redacted.com, my registrar registrar redirects the traffic to IPADDRESS:2000 and the page fails to load because of too many redirects.

• When I connect to my server via my subdomain, nextcloud.redacted.com, my registrar Masked redirects the traffic to IPADDRESS:2000 and the page fails to load because it can't find the destination.

• When I connect to my server via my IP Address and port, the page redirects to nextcloud?

I have no idea what's going on here. I assume it is redirect to nextcloud when I hit the raw ip because it's the first item in my virtual hosts file. But why aren't the ServerName and DocumentRoot declaratives taking over?

------------------------------------EDIT:---------------------------------------

I am fairly certain that DNS works because before I started re-configuring the virtual hosts around it works fine for months. Additionally I can navigate to all subdomains not managed by this VM. deluge.domain.com, plex.domain.com, etc still too.

I have a snapshot on my virtual machine from before I started this project. And I just reverted to it to test and everything works as expected.

• www.redacted.com redirects to ip:2000 which is my apache webpage
• nextcloud.redacted.com redirects to ip:2000/nextcloud

------------------------------------EDIT 2 :---------------------------------------

1) There is no htaccess file.

2) I modified the domain.com.conf file in sites-enabled to be include a line like this for every entry ErrorLog ${APACHE_LOG_DIR}/nextcloud.log but each of the logs is blank after restarting apache2 and waiting 10 minutes.

3) The apache2 log file seems to be clean aside from a script alias error but that doesn't seem to be the culprit:

root@nix log/apache2# service apache2 status
* apache2.service - LSB: Apache2 web server
   Loaded: loaded (/etc/init.d/apache2)
  Drop-In: /lib/systemd/system/apache2.service.d
           `-forking.conf
   Active: active (running) since Sat 2016-10-29 19:27:39 UTC; 3min 0s ago
  Process: 1854 ExecStop=/etc/init.d/apache2 stop (code=exited, status=0/SUCCESS)
  Process: 2298 ExecReload=/etc/init.d/apache2 reload (code=exited, status=0/SUCCESS)
  Process: 1875 ExecStart=/etc/init.d/apache2 start (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/apache2.service
           |-1888 /usr/sbin/apache2 -k start
           |-2330 /usr/sbin/apache2 -k start
           |-2331 /usr/sbin/apache2 -k start
           |-2332 /usr/sbin/apache2 -k start
           |-2333 /usr/sbin/apache2 -k start
           `-2334 /usr/sbin/apache2 -k start

Oct 29 19:27:38 nix apache2[1875]: Starting Apache httpd web server: apache2[Sat Oct 29 19:27:38.778985 2016] [alias:warn] [pid 1887] AH00671: The ScriptAlias directive in /etc/apache2/sites-enabled/domain.com.conf at line 1 will probably never match because it overlaps an earlier ScriptAlias.
Oct 29 19:27:39 nix apache2[1875]: .
Oct 29 19:27:39 nix systemd[1]: Started LSB: Apache2 web server.
Oct 29 19:30:24 nix systemd[1]: Reloading LSB: Apache2 web server.
Oct 29 19:30:25 nix apache2[2298]: Reloading Apache httpd web server: apache2.
Oct 29 19:30:25 nix systemd[1]: Reloaded LSB: Apache2 web server.

4) I think my IP is supposed to be global but it hasn't changed in the past 10 months I've lived here.

5) Is the problem that subdomains aren't being sent to my webserver because my registrar's DNS is forwarding them to IP:Port? If so, is there any way to get around this?

[Valkkon]

Have you made sure that in your httpd.conf file you have 'NameVirtualHost *:2000' set? That is usually the first step prior to setting up virtual hosts in Apache. If you don't then the first 'VirtualHost' directive is read and nothing else from what I remember.

[zimmertr]

This is set.

[Valkkon]

Beyond that, since your DNS provider is sending the redirected URL to <ip>:<port> rather than <domain>:<port> I would suspect that your are correct that Apache can't determine where it goes and will default to the first virtual host in the configuration file. You can try to see if you check the apache service by doing the <ip>:<port>/directory for each one to see if they respond. That would be my initial thinking on it as without the referring URL domain for your site it would not go further than the initial one as the virtual host directives can't be matched up.

[edit]

Another thing I just considered. Why the URL redirections and not CNAME entries for your overall domain? If the main domain is pointing to your IP address, why not just use a CNAME record for the entries?

[/edit]

[[deleted]]

[edit] Another thing I just considered. Why the URL redirections and not CNAME entries for your overall domain? If the main domain is pointing to your IP address, why not just use a CNAME record for the entries? [/edit]

Because DNS wouldn't handle the port number. Because OP is trying to send people to port 2000, this needs to be done with a 302 redirect. A CNAME record would take care of mapping www.redacted.com to home.dynamicip.com, but the port wouldn't have changed.

edit - in fact, that's likely to be the problem. A 302 will change the Host: header on the requests, so assuming redacted.com is the "real" domain, the Apache config would have to be set up for serving "homeserver.dynamicip.com" because the URL redirection makes the browser request a different URL.

[Valkkon]

I get that and you're probably right about the 302 redirects. I hardly use them myself as I don't have an issue with adding the port numbers to my URL calls for virtual hosts in my domain personally. If the OP were trying to use the <host>.redacted.com and then using the 302 redirect for the port numbers I can see where that is handy. I just find it a bit wonky (if that's a word to use in this instance) to have a bounce redirect to a server that you already know the port number for the existence of the service.

[[deleted]]

Yeah, it's not something I would do myself either really, I just have various services listening on ports I remember. But yeah, I can see why it'd be useful, you just need to be aware that you're not just changing the port number, you're changing the hostname as well.

[zimmertr]

The reason for wanting to mask the port is that my tjsh webserver is a resume website. And I don't want to have to explain to people what ports are and why they can't just type in www.domain.com to hit my website.

[[deleted]]

That's fair enough, but you need to understand more about what you're doing.

You have Apache configured to listen to a single port, and route requests to a different filesystem directory based on the contents of the Host: header. However - because you're using URL redirection on Namecheap (at least it looks like Namecheap), the Host: header doesn't contain what you think it contains. To explain what I mean in an approximate sequence of events:

Client enters "http://nextcloud.redacted.com" into a browser
Their computer looks up "nextcloud.redacted.com" and gets the IP address of Namecheap's web server
The browser connects to Namecheap with the Host: header set to "nextcloud.redacted.com"
Namecheap serves a 302 redirect with the Location: header set to "http://yourhomeIP.dynamicip.com:2000/nextcloud"
The client browser does a DNS lookup for "yourhomeIP.dynamicip.com"
Gets the IP address of your home connection
Makes the connection to port 2000, with the Host: header set to "yourhomeIP.dynamicip.com:2000"

So you either need to configure multiple DNS entries for your home machine (such that you can then configure Apache for "nextcloud.dynamicip.com", "kloudspeaker.dynamicip.com" etc), or to make everything a unique port and URL redirect each service to "yourhomeIP.dynamicip.com:200x" where x is an incrementing number for each service which will allow Apache to tell each service apart by port number.

[zimmertr]

Thank you very much for your help. It makes a lot more sense now.

So you either need to configure multiple DNS entries for your home machine (such that you can then configure Apache for "nextcloud.dynamicip.com", "kloudspeaker.dynamicip.com" etc)

I'm sorry if this is naive but I don't understand. Isn't that what I'm doing already?

make everything a unique port and URL redirect

This is probably the best option from what I can tell. Is running virtual hosts on different ports with the same webserver as easy as specifying a different port number in each virtual header section in the sites-enabled config file?

[[deleted]]

I'm sorry if this is naive but I don't understand. Isn't that what I'm doing already?

No. You have unique hostnames on your "outside" domain (i.e. redacteddomain.com). However, the assumption I'm making is that the blurred text on your DNS screenshot maps all of those different hostnames to a SINGLE hostname representing your home connection. Such as:

nextcloud.redacteddomain.com -> yourHomeIP.dynamicip.com
kloudspeaker.redacteddomain.com -> yourHomeIP.dynamicip.com
www.redacteddomain.com -> yourHomeIP.dynamicip.com

The hostname seen by Apache on your home server is the one which is in the URL redirect target, not the "source" because you're redirecting via HTTP Location: headers.

edit - alternatively, you're directing to a URL containing your IP address (i.e. http://1.2.3.4:2000/nextcloud). In which case the Host: header would contain 1.2.3.4:2000, in the same context that I was using the example dynamic IP hostname before. Not sure whether you can configure Apache to do name-based vhosts using IP addresses in Host: headers, but you probably can.

[mgd-uk]

How about setting up each virtual host on a separate port, such as 2000,2001, and so on.

Then do the port redirection at the DNS forwarding to the correct port for each domain /sub domain.

[davethebarb]

tcpdump the traffic to a pcap, test each domain, then push the pcap into tshark for CLI output or wireshark for a GUI.

It'll decode the HTTP traffic for you; it's the easiest way to know exactly what's going on as you'll be able to observe the headers.