I am using ubuntu 12.04, it has to network cards, A = internal 10.0.0.0 and B public Ip , I have only apache2 installed, after 2 to 10 hours the website shows as a blank white page on the public network but continues to appear normally on the private 10.0.0.0 network, if I login or sometimes restart apache or the server the site comes back on the public network, but after 2 to 10 hours will become a blank white page and in chrome sometimes err_empty_response. the apache logs show no problems, the external firewall is setup and working properly, there is no port forwarding and the gateway on the server is correct. this is driving me crazy now, I have reinattled multiple times, removing php on the next install, I have 3 seperate servers all doing the same thing, I have a 4th email server which is fine, no problems, and 2 nameservers with no problems, all ubuntu 12.04, this problem appeared about 3 months ago after the servers were working fine for 6 months, it just started, i had posted a similar post and closed it assuming it wasnt an ubuntu problem bu this has to be. not sure if it could be a security issue. I have performed the following security on all 3.
Secure shared memory vi /etc/fstab tmpfs /dev/shm tmpfs defaults,noexec,nosuid 0 0
SSH Hardening vi /etc/ssh/sshd_config PermitRootLogin no
Protect su by limiting access only to admin group. sudo groupadd admin sudo usermod -a -G admin my-username sudo dpkg-statoverride --update --add root admin 4750 /bin/su
Harden network with sysctl settings
IP Spoofing protection
net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1
Ignore ICMP broadcast requests
net.ipv4.icmp_echo_ignore_broadcasts = 1
Disable source packet routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0
Ignore send redirects
net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0
Block SYN attacks
net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_max_syn_backlog = 2048 net.ipv4.tcp_synack_retries = 2 net.ipv4.tcp_syn_retries = 5
Log Martians
net.ipv4.conf.all.log_martians = 1 net.ipv4.icmp_ignore_bogus_error_responses = 1
Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0 net.ipv6.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv6.conf.default.accept_redirects = 0
Prevent IP Spoofing vi /etc/host.conf order bind,hosts nospoof on
Then in apache I performed the following
installed it
apt-get install apache2
Disable Directory Listings /etc/apache2/conf.d/security ServerToken Prod ServerSignature Off
Disabling unnecessary modules a2dismod status a2dismod autoindex rm -f /etc/apache2/mods-enabled/autoindex.load rm -f /etc/apache2/mods-enabled/autoindex.conf rm -f /etc/apache2/mods-enabled/dav.load rm -f /etc/apache2/mods-enabled/dav_fs.conf rm -f /etc/apache2/mods-enabled/dav_fs.load rm -f /etc/apache2/mods-enabled/dav_lock.load
Also I have webmin installed on port 10000.
if I login to webmin or ssh into the server using putty the site appers again sometimes on the public network, keep in mind the site appears normally the entire time on the private network and also if I'm on the same subnet at the public network. it only across the net that this problem occurs, I have verizon fios with 10 public ip's.
this is my configuration, not sure if anything is creating an issue. any help would be greatly appreciated