Help with bozohttpd on Netbsd

cam-k

Hello,

I'm trying to use the built-in httpd server that ships with NetBSD, and I'm trying to get virtual hosts working and it doesn't seem to want to work. I've followed the man page and put the line in the EXAMPLES section regarding virtual hosting in inetd.conf, but no luck.

`
To configure set of virtual hosts, one would use an inetd.conf(5) entry
like:

 http stream tcp  nowait:600 _httpd /usr/libexec/httpd httpd -v /var/vroot /var/www

 and inside /var/vroot create a directory (or a symlink to a directory)
 with the same name as the virtual host, for each virtual host.  Lookups
 for these names are done in a case-insensitive manner, and may include
 the port number part of the request, allowing for distinct virtual hosts
 on the same name.

in my vroot I've tried a combination of domain names, like example.com, just example or even the full www.example.com, each with an index.html file in them, but i always get a 404.

It's only if I were to type in the browsers URL example.com/example.com, will it go to the example.com directory and display the index html file there, but that doesn't seem to follow the behavior that is laid out in the man page.

rvp

cam-k For name-based virtual hosting to work, the client has to present the correct server hostname in the HTTP request. This means you have to setup either DNS or /etc/hosts so that the client can send such a request.

On the server:

# install -d -m 700 -o www -g www /tmp/www /tmp/vroot/aaa /tmp/vroot/bbb /tmp/vroot/ccc
# httpd -f -n -s -U www -X -v /tmp/vroot /tmp/www

On the client(s):

# echo '192.168.1.100        aaa' >> /etc/hosts
# echo '192.168.1.100        bbb' >> /etc/hosts
# echo '192.168.1.100        ccc' >> /etc/hosts

$ lynx aaa
$ lynx bbb
$ lynx ccc

Use the correct server IP address and user/group name for the http-server, of course.

cam-k

rvp

On any desktop though, is the DNS not setup automatically? By typing in example.com in my browser on Linux Mint, is the DNS not invoked then and thus example.com is present in the request?

rvp

cam-k By typing in example.com in my browser on Linux Mint, is the DNS not invoked then and thus example.com is present in the request?

DNS resolution has to happen first before HTTP requests can be sent. This means that example.com has to resolve to an IP address.

Name-based virtual hosting happens as follows:

User types example.com in the URL-bar.
Browser resolves this to IP address 1.2.3.4.

Connect to the HTTP port on 1.2.3.4 and send a HTTP request like this:

GET / HTTP/1.1
Host: example.com

Suppose now that the user types in example.net instead.

Browser resolves this to the same IP address 1.2.3.4 (name-based virtual hosting).

Connect and send this HTTP request now:

GET / HTTP/1.1
Host: example.net

Because the Host: header sent by the client is different, the HTTP server can easily disambiguate and serve different sets of files.

You can see all this in action if you use curl -v.

cam-k

rvp

Ok, so I've messed around with it a little bit and it seems to be working now. I don't know what I did before, vs now, but it is now serving html pages under /var/vroot/example.com. It seems to be quite finicky.

I've also found that if you remove the execute bit from the directory permission from all other users, it will give a 404, which is very weird. I thought it would only matter if the read bit was there or not. It is owned by root:wheel.

rvp

cam-k It seems to be quite finicky.

How?

cam-k 've also found that if you remove the execute bit from the directory permission from all other users, it will give a 404, which is very weird.

This is how any Unix will behave. In order to access a file in any directory, you need to have execute permissions for all the directories leading up to it. So, if you run httpd as user _httpd, and the dir. is owned by root:wheel, then other users will need to have the x bit set.

cam-k I thought it would only matter if the read bit was there or not. It is owned by root:wheel.

The read bit for directories lets you list its contents. Without the read bit on a dir., httpd's directory indexing option (-X) won't work.

You can exploit this property to create accessible, but, non-listable directories on Unix (perfect for httpd): set the x bit and remove the r bit. Then, if you know the names of the files in that dir. you can access them, otherwise you won't even know they exist.