mod_rewrite woes

[dang]

I'm running suse 9.1 pro, with apache 2.0 prefork. I enabled mod_rewrite, but i cant get it to work for some reason.

Example of my .htaccess:

DirectoryIndex index.php index.cgi index.pl index.shtml index.html

# deny most common except .php
<FilesMatch "\.(inc|tpl|h|ihtml|sql|ini|conf|class|bin|spd|them e|module|exe)$">
deny from all
</FilesMatch>

#Disable .htaccess viewing from browser
<Files ~ "^\.ht">
Order allow,deny
Deny from all
Satisfy All
</Files>

<Limit GET PUT POST>
Order Allow,Deny
Allow from all
</Limit>

RewriteEngine on

RewriteRule /index.html /index.php
RewriteRule bob.html index.php


Now if i load the web page for this, http://192.168.0.9/bob.html or index.html, i get a file not found even though there is a index.php.

Any thoughts? I've verified that the config files load mod_rewrite, and i'm not getting any errors when starting/restarting apache.

Error in /var/log/apache2/error_logs:
[Tue Mar 15 13:18:56 2005] [error] [client 192.168.0.4] File does not exist: /srv/www/htdocs/bob.html

[spankers]

Have you tried enabling RewriteLog? It should give you a better picture of what mod_rewrite is doing. I've only used rewrite once in conjuction with ZOPE and it was a trial and error process. Luck!

[dang]

I have not. Is it just RewriteLog on in the .htaccess file or in httpd.conf (probably doesnt matter I guess)

[llbbl]

here is a good apache book that might have it.

http://www.amazon.com/exec/obidos/tg/detail/-/0596002033/

I cancelled my safarri subscription otherwise i could look up your problem on that.

[spankers]

RewriteLog & RewriteLogLevel should be in httpd.conf (I don't think you can use them in per directory .htaccess).

Per Apache docs RewriteLog will slow your server though. Disable after debugging.
http://httpd.apache.org/docs/mod/mod_rewrite.html

[dang]

Ya, i enabled it through httpd.conf

I changed my rewrite rule in .htaccess trying to figure out whats going on:

<DIRECTIVE /srv/www/htdocs>
RewriteRule ^index.html http://192.168.0.9/index.php
RewriteRule bob.html index.php
</DIRECTIVE>

Here is error in log:
192.168.0.4 - - [17/Mar/2005:10:18:47 --0800] [192.168.0.9/sid#80a5e48][rid#81aba70/initial] (2) init rewrite engine with requested uri /index.html
192.168.0.4 - - [17/Mar/2005:10:18:47 --0800] [192.168.0.9/sid#80a5e48][rid#81aba70/initial] (1) pass through /index.html


That's all it says, I have logging at 9 to trap everything. Not a lot of help :(

[spankers]

The rewrite condition for RewriteRule is voodoo... have you tried anything like:
RewriteRule ^index\.html$ index.php

I believe you have to escape dots with a "\" and end the condition with "$".

[spankers]

I found a thread discussing rewrites to php here:
http://www.webmasterworld.com/forum92/99.htm
(Scroll to last post)

I had to make sure I put:
RewriteRule (.*)/index\.html?$ $1/ [R,L]

AFTER

RewriteBase /
RewriteRule ^(.*)\.html$ $1 [C,E=WasHTML:yes]
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^(.*)$ $1.php [S=1]
RewriteCond %{ENV:WasHTML} ^yes$
RewriteRule ^(.*)$ $1.html

Which allows a .php file to be called with .html

When I put it after, I got funky results...

[llbbl]

so you are using mod_rewrite to fake the extension to something else? like if you have a bunch of PHP pages you could call em all .MSsucks but they would still have the .php extension in actuality?

[spankers]

From what I can tell dang just wants to rewrite index.html

http://www.dang_is_cool.org/index.html -> http://www.dang_is_cool.org/index.php

You could also globally rewrite all .html to .php

mod_rewrite is an awesome Apache mod... you can rewrite just about anything... but the learning curve is steep.

[dang]

I've actually worked with mod_rewrite before without issues. It's just for some reason this is causing problems.

For example:
RewriteRule /index.html /index.php

is a valid rule we have on the servers. If someone enters http://www.designtechnica.com/index.html it will load index.php.

This simple rule will not work on my dev box, which is causing the frustration. :)

Technogeek, yes. You make rewrite a url then have it point to the actual real file. It's great for making friendly urls..

So, you could write something like:

RewriteRule ^bob([0-9]*).html index.php?page=$1

So, if the url is http://www.site.com/bob23.html it actually loads http://www.site.com/index.php?page=23

Spankers, unfortunately the thread you referred to requires login, and when I tried to register it wouldnt accept my yahoo or gmail accounts. I dont use my dt account for anything outside work, so poo on them. :) I'll expirement with what you pasted.

[spankers]

Looks like your production Apache server version should not make the difference:
eherr@chernobyl:~$ HEAD http://www.designtechnica.com/
200 OK
Connection: close
Date: Thu, 17 Mar 2005 21:14:31 GMT
Server: Apache/2.0.48 (Unix) mod_perl/1.99_13 Perl/v5.8.0 DAV/2 PHP/4.3.10
Content-Type: text/html; charset=ISO-8859-1
Client-Date: Thu, 17 Mar 2005 21:10:17 GMT
Client-Peer: 69.93.219.20:80
Client-Response-Num: 1
X-Powered-By: PHP/4.3.10

I wouldn't think mod_rewrite rules would have changed. Good luck and post something when you find out what it is.

[dang]

Found out what it was.. really stupid actually.

By default suse sets Options to be none and AllowOverride None.

This mean that no matter what i put in .htaccess, apache was ignoring it. I set both to:
Options FollowSymLinks
AllowOverride All

and voila! mod_rewrite is now working.
The simple rule of:
RewriteRule index.html index.php now works. Yea!!

Thanks for helping me debug this!

[spankers]

Wow! I'd think that would have generated an error message in the logs.

Thanks for helping me debug this!

I didn't do jack... but thanks.

[dang]

You did help. I tried different things you suggested to try to narrow it down. It all helps.

Nope, no error logs because it was ignoring .htaccess. Once I got it to not ignore it, i started getting errors in the error log for all the crap i put in .htaccess trying to get it to work. :)

[llbbl]

``The great thing about mod_rewrite is it gives you all the configurability and flexibility of Sendmail. The downside to mod_rewrite is that it gives you all the configurability and flexibility of Sendmail.''
-- Brian Behlendorf
Apache Group

`` Despite the tons of examples and docs, mod_rewrite is voodoo. Damned cool voodoo, but still voodoo. ''
-- Brian Moore
bem@news.cmc.net



http://httpd.apache.org/docs/mod/mod_rewrite.html

[llbbl]

Here is how to disable HTTP TRACE using mod_rewrite.

Disable HTTP TRACE support

Based on site requirements and policy, consider disabling HTTP TRACE support in web servers. As a best practice, CERT/CC recommends limiting input ("whitelisting") to the minimum set of values required for proper operation of a given application.
&npsp;&npsp;Apache HTTP Server


Use the Apache mod_rewrite module to deny HTTP TRACE requests or to permit only the methods needed to meet site requirements and policy. TRACE requests can be disabled with the following mod_rewrite syntax:

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]&npsp;&npsp;Microsoft Internet Information Services (IIS)


Use the URLScan tool to deny HTTP TRACE requests or to permit only the methods needed to meet site requirements and policy. The default configurations of Urlscan 2.5 (both baseline and SRP) only permit GET and HEAD methods.

http://www.kb.cert.org/vuls/id/867593

[dang]

that code to deny a detailed trace is pretty cool

[llbbl]

It is advised that you turn implement this on a production server. It is listed as a medium level security threat.

[llbbl]

here is the apache page on mod_rewrite.

http://httpd.apache.org/docs-2.0/mod/mod_rewrite.html

1. Although mod_rewrite rewrites URLs to URLs, URLs to filenames and even filenames to filenames, the API currently provides only a URL-to-filename hook. In Apache 2.0 the two missing hooks will be added to make the processing more clear. But this point has no drawbacks for the user, it is just a fact which should be remembered: Apache does more in the URL-to-filename hook than the API intends for it.
2. Unbelievably mod_rewrite provides URL manipulations in per-directory context, i.e., within .htaccess files, although these are reached a very long time after the URLs have been translated to filenames. It has to be this way because .htaccess files live in the filesystem, so processing has already reached this stage. In other words: According to the API phases at this time it is too late for any URL manipulations. To overcome this chicken and egg problem mod_rewrite uses a trick: When you manipulate a URL/filename in per-directory context mod_rewrite first rewrites the filename back to its corresponding URL (which is usually impossible, but see the RewriteBase directive below for the trick to achieve this) and then initiates a new internal sub-request with the new URL. This restarts processing of the API phases.

Again mod_rewrite tries hard to make this complicated step totally transparent to the user, but you should remember here: While URL manipulations in per-server context are really fast and efficient, per-directory rewrites are slow and inefficient due to this chicken and egg problem. But on the other hand this is the only way mod_rewrite can provide (locally restricted) URL manipulations to the average user.


this page is a general discription of all the different settings or commands you have access to.

[llbbl]

here is a good tutorial on mod_rewrite.

http://httpd.apache.org/docs-2.0/misc/rewriteguide.html

Introduction to mod_rewrite

The Apache module mod_rewrite is a killer one, i.e. it is a really sophisticated module which provides a powerful way to do URL manipulations. With it you can do nearly all types of URL manipulations you ever dreamed about. The price you have to pay is to accept complexity, because mod_rewrite's major drawback is that it is not easy to understand and use for the beginner. And even Apache experts sometimes discover new aspects where mod_rewrite can help.

In other words: With mod_rewrite you either shoot yourself in the foot the first time and never use it again or love it for the rest of your life because of its power. This paper tries to give you a few initial success events to avoid the first case by presenting already invented solutions to you.


i'm trying to figure out how to install it now :) lols or if it comes as a standard module in 2.0.

[llbbl]

Below is a list of all of the modules that come as part of the Apache distribution...

http://httpd.apache.org/docs-2.0/mod/

[spankers]

If you're using binaries then it may or may not be included. I had a dedicated server once upon a time that did not include mod_rewrite. I had to upload the tarball and build from source.

[dang]

depends on your distro 2. Suse has it compiled, but doesnt load it. You have add it as a module to load.

[llbbl]

It works if you put the code in a

<VirtualHost *>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACK
RewriteRule .* - [F]
</VirtualHost>

Tag at the end of your httpd.conf file. There might be some other settings you want to enable between these tags like LogLevel and HostNameLookups.

http://httpd.apache.org/docs-2.0/vhosts/

[llbbl]

hmm . ok so how do you check for sure. I tried this command

#find / -name mod_rewrite.c

and the only result is in the source folder of where i complied the program in when I installed it. I am wondering if you have to ./configure mod_rewrite to work. gah I wish the damn apache page was more useful.

[llbbl]

hmm it says on bottom of the page that <IfModule> is the way enable it.

This quite simply lists the name of the source file which contains the code for the module. This is also the name used by the <IfModule> directive.
top

http://httpd.apache.org/docs-2.0/mod/module-dict.html#SourceFile


but maybe this is for other modules and not this one.

[llbbl]

I figured it out eheh :) You have to recomplie it.

mod_rewrite page--
Status: Extension

description of status fields --
Extension
A module with "Extension" status is not normally compiled and loaded into the server. To enable the module and its functionality, you may need to change the server build configuration files and re-compile Apache.

add the following line to your ./configure statement.

" --enable-rewrite=shared"

you guys are helpful :P

[llbbl]

http://corz.org/serv/tricks/htaccess2.php
http://answers.google.com/answers/threadview?id=472608

i tried this .. doesn't work for apache 2.0
http://www.bhatt.id.au/article/37/

htaccess guide.
http://www.javascriptkit.com/howto/htaccess.shtml

[spankers]

Wow... dude.... you have rewrite mania... seek professional help. :0)

[llbbl]

Reffer to previous post.

[llbbl]

I think it works if you also ./configure --enabled-shared=most

but i'm not totally sure.

There are no frikken mod_rewrite.h files in the apache/includes folder nor are there any mod_rewrite.so in the apache/modules folder so basically the only way you can figure out if you have it installed is go look at your ./configure statement to see if it is there or to add that code and see if it works.

[dang]

you do have rewrite mania dont ya?? I'll pray for you...

It was easy for me to see if I had it, i just check for the .so. since I had it in my modules dir, I assumed apache had been built with it. I just had to enable through my httpd.conf.

I prefer using mod_rewrite through .htaccess since you can configure particular domains w/out having to much through a vhost.conf or httpd.conf. The other bonus is if you have plan on having a lot of rewrite rules (like we do) then it's nasty to dump it all into a httpd.conf or vhost.conf. Of course you could always create a new .conf and include it in your vhost/httpd.conf file as well.

Glad you are playing with it! I can come to you with questions. :) If you want practice, I can provide lots. hehe

[llbbl]

I don't understand how it can be working and I don't have a mod_rewrite.so in my modules directory . that doesn't make any sense.

[llbbl]

Note that I changed the code in this post.
http://forums.designtechnica.com/showthread.php?p=48874#post48874

I think it is correct now. Thanks.

[dang]

So you just added
RewriteEngine On

to your root <Directory> in the httpd.conf file and then added the .htaccess as needed?

You can actually put everything in the .htaccess, as in :

RewriteEngine ON
RewriteRule index.html index.php

[llbbl]

You'll need to have Apache's mod_rewrite compiled into your Apache Web Server and you'll need to have access to setting some options up in your httpd.conf or at least have a server admin who's willing to do it for you. You can follow my tutorial for installing Apache web server on Linux here. For quick reference, the configure options for mod_rewrite are:

./configure
--enable-module=rewrite
--enable-shared=rewrite

Here is a quickstart guide is pretty good :) wish i had found it sooner .. lol

http://www.devshed.com/c/a/Apache/Search-Engine-Friendly-URLs-with-mod-rewrite/

[llbbl]

Here is a good step by step article on securing apache.

http://www.cgisecurity.com/lib/ryan_barnett_gcux_practical.html

[llbbl]

Using apache mod_rewrite to battle spam.
http://www.redhat.com/archives/enigma-list/2001-December/msg01838.html

[dang]

oh that spam one is beautiful. i'm sure that list of spam bots has grown..

[llbbl]

I found some places for good apache questions/answers

http://groups-beta.google.com/group/alt.apache.configuration

http://www.apache-httpd.com/

http://news.gmane.org/gmane.comp.apache.user/cutoff=47618

[llbbl]

I figured out how u can check to see what modules you have.

#./httpd -l

I also was able to figure out how you are supposed to implement the mod_rewrite stuff to prevent TRACE and TRACK. I have updated the posts in the thread.