3

I am using ubuntu 12.04, it has to network cards, A = internal 10.0.0.0 and B public Ip , I have only apache2 installed, after 2 to 10 hours the website shows as a blank white page on the public network but continues to appear normally on the private 10.0.0.0 network, if I login or sometimes restart apache or the server the site comes back on the public network, but after 2 to 10 hours will become a blank white page and in chrome sometimes err_empty_response. the apache logs show no problems, the external firewall is setup and working properly, there is no port forwarding and the gateway on the server is correct. this is driving me crazy now, I have reinattled multiple times, removing php on the next install, I have 3 seperate servers all doing the same thing, I have a 4th email server which is fine, no problems, and 2 nameservers with no problems, all ubuntu 12.04, this problem appeared about 3 months ago after the servers were working fine for 6 months, it just started, i had posted a similar post and closed it assuming it wasnt an ubuntu problem bu this has to be. not sure if it could be a security issue. I have performed the following security on all 3.

Secure shared memory vi /etc/fstab tmpfs /dev/shm tmpfs defaults,noexec,nosuid 0 0

SSH Hardening vi /etc/ssh/sshd_config PermitRootLogin no

Protect su by limiting access only to admin group. sudo groupadd admin sudo usermod -a -G admin my-username sudo dpkg-statoverride --update --add root admin 4750 /bin/su

Harden network with sysctl settings

IP Spoofing protection

net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1

Ignore ICMP broadcast requests

net.ipv4.icmp_echo_ignore_broadcasts = 1

Disable source packet routing

net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0 net.ipv6.conf.default.accept_source_route = 0

Ignore send redirects

net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0

Block SYN attacks

net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_max_syn_backlog = 2048 net.ipv4.tcp_synack_retries = 2 net.ipv4.tcp_syn_retries = 5

Log Martians

net.ipv4.conf.all.log_martians = 1 net.ipv4.icmp_ignore_bogus_error_responses = 1

Ignore ICMP redirects

net.ipv4.conf.all.accept_redirects = 0 net.ipv6.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv6.conf.default.accept_redirects = 0

Prevent IP Spoofing vi /etc/host.conf order bind,hosts nospoof on

Then in apache I performed the following

installed it

apt-get install apache2

Disable Directory Listings /etc/apache2/conf.d/security ServerToken Prod ServerSignature Off

Disabling unnecessary modules a2dismod status a2dismod autoindex rm -f /etc/apache2/mods-enabled/autoindex.load rm -f /etc/apache2/mods-enabled/autoindex.conf rm -f /etc/apache2/mods-enabled/dav.load rm -f /etc/apache2/mods-enabled/dav_fs.conf rm -f /etc/apache2/mods-enabled/dav_fs.load rm -f /etc/apache2/mods-enabled/dav_lock.load

Also I have webmin installed on port 10000.

if I login to webmin or ssh into the server using putty the site appers again sometimes on the public network, keep in mind the site appears normally the entire time on the private network and also if I'm on the same subnet at the public network. it only across the net that this problem occurs, I have verizon fios with 10 public ip's.

this is my configuration, not sure if anything is creating an issue. any help would be greatly appreciated

  • Have you checked cabling and / or the network adapter on the public IP? It sounds like a defective HW or power saving mode gets turned on due to lack of traffic. Try to replug the cable when this happens or send a magic packet. Try with a different switch. Does the switch turn off the port? Make sure it is not the network adapter or the connection that is causing your problems. – lgarzo Oct 7 '13 at 7:51
  • I like your answers, I've already replaced the switch, the cables have bben replaced and the card should be fine because if i'm on the same subnet i can see the site, it's when i'm outside the gateway that the problems begin. this problem occurs all 3 seperate servers, it started at the same time. – The Evil Server Room Oct 7 '13 at 13:17
  • Ok I have an update, I have reinstalled several times, the current install was stripped down to eliminate possible conflicts, I have only installed ubuntu 12.04 with apache2, the problem remains the same, after a day or 2 the site is unavailable outside my subnet, however if i'm on the same subnet the site comes righ up, it's as if the gateway setting disappears, now for the strange part, if I ssh in and login, or I open webmin and login the site comes back outside my subnet, I have checkedthe logs and nothing, I have checked my external firewall and nothing. there is no router, just verizon – The Evil Server Room Oct 13 '13 at 19:21
  • 1
    Just wanted to give you an update, I relaxed the security settings and still had that issue, then I used a wget spider cron job and the problem went away, I contacted my ips and they insist the problem is on my end. – The Evil Server Room Oct 21 '13 at 18:07
  • 1
    This is somewhat good news, so you'll need to check your broadband router if it keeps an always-on connection or uses an on-demand one. The latter ceases to work after inactivity, therefore the wget job keeps it alive. – lgarzo Oct 21 '13 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.