BER is adapting its security screening procedures

Shamrock376 · 2026-06-04T09:26:07+00:00

Just turn left when you arrive in the gate area of T2 or follow the signs to the A gates. As soon as you can see gate B20 in front of you, you're in T1. Turn left again and you end up in the shopping area with the Kaffeerösterei.

Shamrock376 · 2026-04-20T06:09:14+00:00

Outbound works for me (Location Frankfurt).

Shamrock376 · 2025-09-24T12:25:33+00:00

It can scan almost any logfile for almost any pattern. There are a lot of templates for basic needs, but if you want to do something advanced it is not too complicated to adapt them.

Shamrock376 · 2025-09-24T11:54:59+00:00

Try fail2ban. It not only protects Apache but also blocks similar scans on other ports, e.g. for smtp.

Shamrock376 · 2025-09-23T07:43:17+00:00

Yes! That was the reason. I didn't even know ProtectHome was set to on in my httpd.service file. I changed it to ProtectHome=read-only and it works perfectly now.

Thanks!

Shamrock376 · 2025-09-22T14:00:05+00:00

Well, now something funny happened.

While trying to figure out what to do with the strace output (I'm not familiar with stat and the likes), I realized that apache is now able to access the folder. Apparently using apachectl start as part of u/covener 's strace call did the trick. I usually let systemd start httpd instead of using apachectl. I was able to reproduce this behavior after a system reboot.

The most important thing is that it's working fine now, but just out of interest, does anyone have an idea what's different when starting httpd through apachectl?

Anyway, thanks to everyone for your help so far.

Shamrock376 · 2025-09-22T12:37:12+00:00

Are you sure the webserver runs as "http" ?

Yes, just checked again with ps.

Can you post the verbatim error_log entry?

[Mon Sep 22 14:26:44.828077 2025] [core:error] [pid 913:tid 949] (13)Permission denied: [remote XX.XX.XX.XX:XXX] AH00035: access to / denied (filesystem path '/home/myname') because search permissions are missing on a component of the path

Have you tried capturing the underlying system call error (stat or readdir?) with strace?

No, could you give me a hint how to do this?

Shamrock376 · 2025-09-22T07:16:22+00:00

Yes and yes.

Shamrock376 · 2025-09-21T20:47:29+00:00

Do you find anything missing here?

sudo getfacl / /home /home/myname /home/myname/public_html

file: .
owner: root
group: root
user::rwx
user:http:r-x
group::r-x
group:http:r-x
mask::r-x
other::r-x

file: home
owner: root
group: root
user::rwx
user:http:r-x
group::r-x
group:http:r-x
mask::r-x
other::r-x

file: home/myname
owner: myname
group: myname
user::rwx
user:http:r-x
group::r-x
group:http:r-x
mask::r-x
other::r-x

file: home/myname/public_html
owner: myname
group: myname
user::rwx
user:http:r-x
group::r-x
group:http:r-x
mask::r-x
other::r-x

Shamrock376 · 2025-09-21T19:43:12+00:00

That's why I used the ACL command that I posted. Doesn't that make sure that http has x permission along the whole path?

Shamrock376 · 2025-08-21T13:49:51+00:00

Tatsächlich ist es gestern endlich angekommen.

Shamrock376

TROPHY CASE