security

[Dani]

Hi,

great job with the server. My friend recommended me to change and oh did it perform as the benchmarks say. The load is about 60% lower if not more some times. The speed has increased with about 50% of before 'havent had time to play with the tuning yet'.

But have a question for the default 404, 403 etc files..

the line "Powered By LiteSpeed Web Server
Lite Speed Technologies is not responsible for administration and contents of this web site!" gets added to the bottom. Is there a way to hide the server info for security reasons? "except using cutom 404 error pages which seem to have a bug when using it on the 401 error...

[mistwang]

Thank you for your praise.

Which error page has problem? 403 or 401?

[Dani]

sorry for confusing you =) 401 gives error. for example I had a realm check on a statis link but it never reached it. I only got to the custom 401 error instead of being asked for the password. When I removed the 401 it worked without any problems.

but is it possible to hide the servername like in apache or is this embedded somehow?

[mistwang]

OK, I see.

That's due to how custom error pages was handled. The information about authentication realm was lost.

We can't fix it right now, however, there is a work around though, set the customized error page to a URL under your protected context.

[jnrey]

For security reasons I would like to hide the name of the Server. I have customized 404 and 503 pages, to no avail; it still displays "Powered By LiteSpeed Web Server Lite Speed Technologies is not responsible for administration and contents of this web site!". Is there any way to hide all this ?

Many thanks !

[brrr]

I think the ability to hide the 'Powered by LSWS' etc only comes with the Enterprise version.

[jnrey]

Well got the trial enterprise version so far, but did not see it. Can this be confirmed by anyone ?

[brrr]

Doesn't:
Configuration > Server > General > General Settings > Server Signature > Hide Full Header

do it?

[mistwang]

Doesn't:
Configuration > Server > General > General Settings > Server Signature > Hide Full Header

do it?
That hide the server signature in the response header.

jnrey want to use a custom error page for 404, 503 errors. It should work even with earlier release of LSWS.


Is LSWS used together with Apache configuration file? or everything configured via LSWS web console? Are you sure the file for the custom error pages exist? try access those pages directly, see what do you get.

[jnrey]

Have set "Hide Full Header", however it doesn't take, using the default message instead . I am only using LSWS web console - no Apache config files - but it doesn't find the VHOST custom error pages (e.g. error404.html under "Default/html" directory - $VH_ROOT/html/).

Again, many thanks for your help.

[mistwang]

You need to create the html file for the custom error page first.

[jnrey]

That was done.

[mistwang]

What do you get if you access the custom error page directly like http://www.yourdomain.com/error404.html ?

[jnrey]

Hi Mistwang. When addressing it manually, I do get the standard 404 page (Request Page Not Found, This is a customized error page for missing pages.) - but this time without the "Powered By" Footer. Also, it is not my own customized 404 page. When the server displays / forwards to error messages 404, 503 etc., the Footer still does appear.

[mistwang]

It is the customer error page comes with default vhost.

You should set http://www.litespeedtech.com/docs/webserver/config/vhostgeneral/#errPage properly, and make sure that when you access the URL specified there directly from browser, your custom error page shows up.

[mistwang]

Make sure to set the URL like "/my_cusotm_error_page_url" without "http:/".

[jnrey]

My custom error pages for the VH are showing up now when I enter them manually (e.g. http://www.mydomain.com/<myerror404.html>), as I adapted and simplified the context and made sure they were under (static: URI "/"). I also have set absolute paths pointing to these urls.

However, when entering a http://www.mydomain.com/<non-exiting.html>, the server still doesn't forward to http://www.mydomain.com/<myerror404.html> as set under corresponding rule 404, but instead still goes to the standard (404 Not Found ... Powered By LiteSpeed Web Server etc.). I am using neither script nor rewrite rules. Am not using .htaccess, and setting is set to "Hide Full Header".

[mistwang]

What is URL for the 404 error page? is that <myerror404.html>? Does <myerror404.html> exist under the document root? You do not need to add a <myerror404.html> context.

[jnrey]

Many thanks Mistwang ! An explicit context like URI "/error404.html" under Doc Root was not even necessary, although this works as well. Rather, one could use the URI "/" under a location like "directory1/", e.g. for a group of static urls like the error ones. What was essential - besides including the context andtesting the manual display or the urls - was to declare urls relative to Doc Root under Customized Error Pages, NOT absolute paths.

[trembler]

damw dude that is wack :eek:

http://www.litespeedtech.com/support/wiki/doku.php?id=litespeed_wiki:ruby_rails_mongrel%00.j pg

[jnrey]

Works here. What's wrong now then.

[viettechorg]

Can you please tell me step-by-step how to do it? Mine shows default errors even i changed them.

[jordan]

Well got the trial enterprise version so far, but did not see it.

[jnrey]

Hi Mistwang. Although I have done my own 400.html page with server setting "Hide Full Header" and e.g. my own 404.html does show, this message below is not replaced by my 400.html page. Although the title below is "400 Bad Request", and my message 400 is maintained under VH - General - Cust Error Pages. Also, when I enter the direct <site path>.400.html, my 400 does come up properly. How can I replace this message below ? It is triggered when I enter http:<site>:443. Many thanks.

HTTPS is required

This is an SSL protected page, please use the HTTPS scheme instead of the plain HTTP scheme to access this URL.

Hint: The URL should starts with https://

Powered By LiteSpeed Web Server
http://www.litespeedtech.com

<html><head><title>400 Bad Request</title></head><body>
<h2>HTTPS is required</h2>
<p>This is an SSL protected page, please use the HTTPS scheme instead of the plain HTTP scheme to access this URL.<br />
<blockquote>Hint: The URL should starts with <b>https</b>://</blockquote> </p>
<hr />
Powered By LiteSpeed Web Server<br />
<a href='http://www.litespeedtech.com'><i>http://www.litespeedtech.com</i></a>
</body></html>

[jnrey]

Hi again Mistwang. Any clue ?

[mistwang]

In our upcoming 4.0 release, I will added server wide custom page.

[anewday]

In our upcoming 4.0 release, I will added server wide custom page.

Great, something I wanted for a while. How about on a vhost level too?

[mistwang]

vhost level custom error page is available now, it is just that a 400 error page does not below to any vhost as LSWS does not finish parsing the request at all. so it has to be set at server level.

[netnoise]

In our upcoming 4.0 release, I will added server wide custom page.

I just downloaded the beta package but couldn't find this option. BTW: I find it would be much more convenient if the built-in error pages would appreciate the "Server Signature" setting...

[mistwang]

Please wait for beta 2.