danskoya.com

Resolving issues when you encounter 401 (auth) or 403 (forbidden) related errors is relatively easy. Tailing log files and looking at directory/file permissions from the console is the starting point.

But what happens when you encounter what is called an “500 – Internal Server Error”? It turns out, there are multiple levels of logging available you can set globally or within the context of a <Directory> or <VirtualHost > directive. See https://httpd.apache.org/docs/2.4/en/mod/core.html#loglevel for more details.

In one of our hiccups, setting “LogLevel trace8” revealed inadequate permissions were set for the DavLockDB file – rendering endless error 500s when transferring files or creating new folder/directories.


[Sun Dec 30 06:57:17.xxxxxx 2018] [dav:error] [pid xxxxx:tid xxxxxxxxx] [client x.x.x.x:xxxxx] Could not open the lock database. [500, #400]


[Sun Dec 30 06:58:27.xxxxxx 2018] [dav:error] [pid xxxxx:tid xxxxxxxxx] [client x.x.x.x:xxxxx] The locks could not be queried for verification against a possible "If:" header. [500, #0]


A simple permissions tweak to DavLockDB /path/to/file and restarting Apache resolved the problem.

Here’s a few Apache 2.4.x directives to look over whenever similar issues arise:


Options
AllowOverride
AuthUserFile
Require
DavLockDB


Looking under the hood, it looks like OpenSSL 1.1.1a is the default install on FreeBSD 12.0-RELEASE base. We use Squid 4.4 & Apache 2.4.37 both of which had to be recompiled.

Just a few notes if you share a similar configuration:

• build /usr/ports/security/openssl111/ or use pkg

## modify /etc/make.conf to reflect

DEFAULT_VERSIONS+=ssl=openssl111

## modify httpd.conf to reflect something similar to these:

SSLProtocol -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2 +TLSv1.3 
SSLCipherSuite TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA

Once all modifications are finalized, restart Apache and fire up https://www.ssllabs.com/ssltest/ to verify.

To verify with Squid, use

$ squid -v
Squid Cache: Version 4.4
Service Name: squid

This binary uses OpenSSL 1.1.1a 20 Nov 2018. For legal restrictions on distribution see https://www.openssl.org/source/license.html

Please note the above configuration purposely disables SSLv3 & TLSv1.0-1.1 – only TLSv1.2 and 1.3 are enabled with corresponding ciphersuites. All other connections will fail.

Danskoya (Norway), Hokkaido (Japan) and Alaska (USA) are three places I’d like to visit someday with my wife & kids.

The serenity, blistering cold, vast spaces of wilderness, tributaries of flowing rivers & lakes, majestic coastlines, the rich history of local natives are just some of the reasons why I am drawn to these remote places.

I don’t spend a lot of time watching television. But if I do, I set aside time to enjoy documentary shows about Alaska on the Discovery Channel, PBS and other stations.

The blog post title is one of those shows alongside “The Last Alaskans”, “Life Below Zero”, “Alaskan Bush People” and many others.

What I find most fascinating with these shows are the endless stories about survival in the outdoors, family and ancestral history, team work with family members & neighbors, passed on traditions and rituals and most importantly – being responsible by taking advantage of opportunities to the fullest.

—
yours truly, @warehouseninja

written by Pete Batard, this neat tool helps you create bootable USB drives of various types of operating systems. It supports .img and .iso source files just to name a few.

The software is free & open-source and can be downloaded from https://rufus.ie/

At Danskoya.com, we utilize Rufus to create & maintain bootdisks for Windows 10 and FreeBSD. It has proven to be very valuable for all our hardware/software deployments.

If you don’t need WebRTC, you can disable it:

In Firefox, type about:config in the URL bar then search for media.peerconnection.enabled, highlight it then right-click and select Toggle to set the Value to false

In Chrome, install the WebRTC Leak Prevent plugin by Aaron Horler and set the IP-handling policy to Disable non-proxied UDP (force proxy)

To test both browsers for IP-address leaks, use https://whoer.net

Danskøya is Norwegian for Danes Island located in Norway’s Svalbard archipelago in the Arctic Ocean.

To learn more, visit the Wikipedia link.