location query string?

2016-09-28 Thread Grant
Can I define a location block based on the value of a query string so I can set a longer timeout for certain form submissions even though all of my form submissions POST to the same URL? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.ngin

Re: nginx reverse proxy causing TCP queuing spikes

2016-09-28 Thread Grant
>> I do think this is related to 'proxy_read_timeout 60m;' leaving too >> many connections open. Can I somehow allow pages to load for up to >> 60m but not bog my server down with too many connections? > > Pardon me, but why on earth do you have an environment in which an HTTP > request can take

Re: fake googlebots

2016-09-28 Thread li...@lazygranch.com
http://pastebin.com/tZZg3RbA/?e=1 This is the access.log file data relevant to that fake googlebot. It starts with a fake googlebot entry, then goes downhill from there. I rate limit at 10/s. I only allow the verbs HEAD and GET, so the POST went to 444 directly. I replaced the domain with a fake

Re: localhost on Passenger delayed serve

2016-09-28 Thread Viaduct Lists
Never mind. Solved. > On Sep 28, 2016, at 6:12 PM, Viaduct Lists > wrote: > > Hi folks. A localhost passenger domain (hq.local) isn’t showing up on my > local Safari. It’s pointed properly in the hosts file and Firefox takes > about 10 seconds to show it, but Safari just waits for it.

localhost on Passenger delayed serve

2016-09-28 Thread Viaduct Lists
Hi folks. A localhost passenger domain (hq.local) isn’t showing up on my local Safari. It’s pointed properly in the hosts file and Firefox takes about 10 seconds to show it, but Safari just waits for it. Curl also takes about 10 seconds to show the page, but it does show up using: curl —basi

Re: How to enable OCSP stapling when default server is self-signed?

2016-09-28 Thread Maxim Dounin
Hello! On Wed, Sep 28, 2016 at 12:44:45PM -0400, hotwirez wrote: [...] > I wanted to mention that I've run into this issue as well when trying to > enable OCSP stapling, where I have a default_deny SSL server that has a > self-signed certificate where I don't want to use OCSP stapling, and other

Re: 444 return code and rate limiting

2016-09-28 Thread lists
I don't do 444 for rate limiting. I figure a hacker doesn't deserve a response. I see the occasional double request, but not 10. Most likely the entity trying to log into my WordPress control panel  is not typing

Re: nginx reverse proxy causing TCP queuing spikes

2016-09-28 Thread Robert Paprocki
> I do think this is related to 'proxy_read_timeout 60m;' leaving too > many connections open. Can I somehow allow pages to load for up to > 60m but not bog my server down with too many connections? Pardon me, but why on earth do you have an environment in which an HTTP request can take an hour

Re: nginx reverse proxy causing TCP queuing spikes

2016-09-28 Thread Grant
>> I've been struggling with http response time slowdowns and >> corresponding spikes in my TCP Queuing graph in munin. I'm using >> nginx as a reverse proxy to apache which then hands off to my backend, >> and I think the proxy_read_timeout line in my nginx config is at least >> contributing to t

Re: 444 return code and rate limiting

2016-09-28 Thread Richard Stanway
Keep in mind a terminated connection (444) is not a valid HTTP response. Abruptly terminated connections may also be caused by broken middleware boxes or other things interrupting the connection. Modern browsers have retry mechanisms built in to safeguard against transient connection issues, for ex

Re: 444 return code and rate limiting

2016-09-28 Thread lists
If you just reply to these hackers, you will be "pinged" until oblivion. I choose to fight, you don't. I have a different philosophy. I log the offenders and if from a colo, VPS, etc., they can enjoy their lifetim

Re: 444 return code and rate limiting

2016-09-28 Thread B.R.
If you are to quote what you call documentation, please use some real one: http://nginx.org/en/docs/http/request_processing.html#how_to_prevent_undefined_server_names What I said before remains valid: accepting connection, reading request & writing response use resources, by design, even if you th

Re: How to enable OCSP stapling when default server is self-signed?

2016-09-28 Thread hotwirez
Maxim Dounin Wrote: --- > Hello! > > On Sun, Apr 12, 2015 at 12:21:19PM -0400, numroo wrote: > > > >> Yes, I ran the s_client command multiple times to account for the > nginx > > >> responder delay. I was testing OCSP stapling on just one of my

Re: nginx can't spawn sub process

2016-09-28 Thread Maxim Dounin
Hello! On Wed, Sep 28, 2016 at 03:41:38PM +, shang yu wrote: > I compiled nginx 1.8.1 from source on Windows XP . when I run it > , it can spawn sub process but the sub process crashed > immediately . > > BTW , because I did not install cygwin on my system . I create > the needed files ng

Re: Inquiry regarding support for OpenSSL 1.0.2i

2016-09-28 Thread Jonathan Vanasco
On Sep 28, 2016, at 5:34 AM, jhernandez wrote: > But we're not sure if 1.10.1 would support OpenSSL 1.0.2i. Has anyone tried > this approach before ? FYI, OpenSSL 1.1 and 1.02 branches had security fixes on 9/26 to their 9/22 releases The current releases are: 1.0.2j 1.1.0b

nginx can't spawn sub process

2016-09-28 Thread shang yu
Hi dear all, I compiled nginx 1.8.1 from source on Windows XP . when I run it , it can spawn sub process but the sub process crashed immediately . BTW , because I did not install cygwin on my system . I create the needed files ngx_auto_headers.h ngx_auto_config.h and ngx_modules.c ngx_auto_hea

Re: Inquiry regarding support for OpenSSL 1.0.2i

2016-09-28 Thread Valentin V. Bartenev
On Wednesday 28 September 2016 17:34:58 jhernandez wrote: > Hello, > > We've recently received a notification regarding a vulnerability in > OpenSSL: > OCSP Status Request extension unbounded memory growth (CVE-2016-6304) > This is fixed in OpenSSL v1.0.2i > > We're running an Nginx proxy server

Re: Inquiry regarding support for OpenSSL 1.0.2i

2016-09-28 Thread itpp2012
Try this one http://nginx-win.ecsds.eu/ with 1.0.2j Posted at Nginx Forum: https://forum.nginx.org/read.php?2,269889,269898#msg-269898 ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Static or dynamic content

2016-09-28 Thread Jens Dueholm Christensen
Hi I've got an issue where nginx (see below for version/compile options) returns a 405 (not allowed) to POST requests to clients when the upstream proxy returns a 503. I know nginx doesn't allow posts to static content, but since all content (even static js, png etc) is served by upstream I ca

Inquiry regarding support for OpenSSL 1.0.2i

2016-09-28 Thread jhernandez
Hello, We've recently received a notification regarding a vulnerability in OpenSSL: OCSP Status Request extension unbounded memory growth (CVE-2016-6304) This is fixed in OpenSSL v1.0.2i We're running an Nginx proxy server on Windows 2012 R2 and are currently using Nginx 1.9.9 - with OpenSSL