Can't access sub-domains local or www

Problems with the Windows version of XAMPP, questions, comments, and anything related.

Can't access sub-domains local or www

Postby puttsy » 31. December 2011 07:40

Hey all, I've got a bit of an odd (but common?) issue with accessing subdomains. I know most applications I am installing are NOT supported here so, no need to speak on that unless you have a good idea.

XAMPP Control Panel v. 2.5
Windows 7 Pro x64


I have these address in my windows hosts file:

127.0.0.1 wiki.mydomain.com
127.0.0.1 forum.mydomain.com
127.0.0.1 phpbb.mydomain.com
127.0.0.1 wordpress.mydomain.com

and in my httpd_vhosts.conf

#----------wordpress-------------------------
<VirtualHost *:80>
ServerName wordpress.mydomain.com
ServerAlias www.wordpress.mydomain.com
DocumentRoot "C:/xampp/htdocs/wordpress"
ServerAdmin me@mydomain.com
</VirtualHost>

#----------wiki-------------------------
<VirtualHost *:80>
ServerName wiki.mydomain.com
ServerAlias www.wiki.mydomain.com
DocumentRoot "C:/xampp/htdocs/wiki"
ServerAdmin me@mydomain.com
</VirtualHost>

#---------SMB.forum----------------------
<VirtualHost *:80>
ServerName forum.mydomain.com
ServerAlias www.forum.mydomain.com
DocumentRoot "C:/xampp/htdocs/forum/"
ServerAdmin mydomain@mydomain.com
</VirtualHost>

(I also have SMF instlled and written out like those^)


and here's what the httpd_xampp.conf looks like: (bottom line. only one I've changed)

# Close XAMPP sites here
<LocationMatch "^/(?i:(?:xampp|licenses|phpmyadmin|webalizer|server-status|server-info))">
Order deny,allow
#Deny from all
Allow from ALL
ErrorDocument 403 /error/HTTP_XAMPP_FORBIDDEN.html.var
</LocationMatch>

BUT, when I type in wiki.mydomain.com, I get directed to the forum, when I type in wordpress.mydomain.com, I get sent to SMF forum page. If I type in just localhost in my browser, I get sent to the forum. I got wordpress, wiki, and SMF all installed but something is getting in the way with SMF (the item i plan on using the very least of!)

Any ideas on what may be causing this and how to fix it? Does the <locationmatch> look correct to be used to access these pages from outside my network?
puttsy
 
Posts: 6
Joined: 24. December 2011 09:21
Operating System: Windows 7 Pro x64

Re: Can't access sub-domains local or www

Postby Sharley » 31. December 2011 08:42

Big security hole:
puttsy wrote:Does the <locationmatch> look correct to be used to access these pages from outside my network?
This is a security measure for the folders listed, which are XAMPP system folders and should not be able to be accessed other than from localhost.
You should put it back to the default settings or you could open a big hole in your security - it has no effect on your other issues.

For access from other locations you should specify the IP address of who will have access instead of a blanket Allow from all
Code: Select all
# Close XAMPP sites here
<LocationMatch "^/(?i:(?:xampp|licenses|phpmyadmin|webalizer|server-status|server-info))">
    Order deny,allow
    Deny from all
    Allow from 127.0.0.1
    Allow from 192.168.0.0/16
    Allow from 123.123.123.123
    ErrorDocument 403 /error/HTTP_XAMPP_FORBIDDEN.html.var
</LocationMatch>
You can add who you trust but not everyone on the Internet, big mistake.



Here is a httpd-vhosts.conf and HOSTS file based on the info you provided to try
Code: Select all
NameVirtualHost *:80

##----------localhost--------------------
<VirtualHost *:80>
ServerName localhost
##make sure the localhost index.php is in this folder
DocumentRoot "C:/xampp/htdocs"
</VirtualHost>

##----------wordpress--------------------
<VirtualHost *:80>
ServerName wordpress.mydomain.com
ServerAlias www.wordpress.mydomain.com
DocumentRoot "C:/xampp/htdocs/wordpress"
ServerAdmin me@mydomain.com
</VirtualHost>

##----------wiki-------------------------
<VirtualHost *:80>
ServerName wiki.mydomain.com
ServerAlias www.wiki.mydomain.com
DocumentRoot "C:/xampp/htdocs/wiki"
ServerAdmin me@mydomain.com
</VirtualHost>

##---------SMB.forum---------------------
<VirtualHost *:80>
ServerName forum.mydomain.com
ServerAlias www.forum.mydomain.com
##No trailing slash here
DocumentRoot "C:/xampp/htdocs/forum"
ServerAdmin me@mydomain.com
</VirtualHost>
Save the file and restarts Apache after adding each vhosts

Best method is not to add all the vhosts at once but to add one at a time testing each is working before adding another.

I prefer to add the Directory directive for each vhost then I can configure each vhost's Options etc. but at this stage the Directory directive in use will be that for htdocs in the httpd.conf file.
Code: Select all
127.0.0.1 localhost
127.0.0.1 wiki.mydomain.com
127.0.0.1 www.wiki.mydomain.com
127.0.0.1 forum.mydomain.com
127.0.0.1 www.forum.mydomain.com
127.0.0.1 phpbb.mydomain.com
127.0.0.1 www.phpbb.mydomain.com
127.0.0.1 wordpress.mydomain.com
127.0.0.1 www.wordpress.mydomain.com

See how that goes and if you still have problems follow the add one at a time suggestion.


Why don't you use the version 3 control panel found in the xampp installation folder:
xampp-control-3-beta.exe
Latest version download link in my signature, simply extract to the xampp installation folder and overwrite when asked then right click to run as administrator and to create a shortcut for easier access, to the desktop for example.

It is much improved over the 2.5 version with many great new features.

Good luck. :)
User avatar
Sharley
AF Moderator
 
Posts: 3316
Joined: 03. October 2008 05:10
Location: Yeppoon, Australia Time Zone: GMT/UTC+10
Operating System: Win 7 Pro 32bit/XP Pro SP3

Re: Can't access sub-domains local or www

Postby puttsy » 31. December 2011 18:16

Thanks for all the info Sharley. It truly is appreciated.

I'm testing these all one by one to see what happens and it seems to be working as expected, finally.

Now, I have a question about the access. I understand that the "Allow from ALL" is a major (yes, very large) security issue AND, that XAMPP is NOT meant to be used in production; That's not my intent. I AM wondering though, what is a better and more secure way to allow global access to the sites but also maintain security? Due to the fact that I am constantly traveling, how would I easily access my content while outside of my LAN and using different IP's from place to place? Is there an add-on or program I can use to require logging into any of my content? Say, I type in: wiki.mydomain.com and receive the "Authentication Required" dialog/window as soon as I connect to that site? Like how routers and such do it? I know I've seen it before (and actually set it up some time ago with a Filezilla server/client) but, can't figure out how I should do it again.

Also, thanks for the tip on using Control Panel v. 3. Is there an easy way to make it the default CP? Only reason I was using 2.5 was because it was the default thus, it started when Windows started (Installed it as a service).

Thanks for the loads of help. It truly is an amazing learning experience.
puttsy
 
Posts: 6
Joined: 24. December 2011 09:21
Operating System: Windows 7 Pro x64

Re: Can't access sub-domains local or www

Postby Altrea » 31. December 2011 20:07

Hi puttsy,

puttsy wrote:Now, I have a question about the access. I understand that the "Allow from ALL" is a major (yes, very large) security issue AND, that XAMPP is NOT meant to be used in production; That's not my intent.

production means, that the sensitive parts are accessible from the internet or another big network. Sensitive parts are the MySQL Administration phpmyadmin, the orange XAMPP Administration page, the security page and some special Apache information pages. That are the parts protected by the new security concept.

All other pages, like subfolder in htdocs, are not protected by this security concept and in most cases they don't need to. You can use Wordpress, phpBB, or other scripts and surely can access them from any network if you wish. But the sensitive parts should leave protected.

If you need a really production proof webserver stack, see my signature. Zend Server (CE) can be used in production environments, is free too and easy to install, but not as compact as XAMPP is.

puttsy wrote:I AM wondering though, what is a better and more secure way to allow global access to the sites but also maintain security?
Due to the fact that I am constantly traveling, how would I easily access my content while outside of my LAN and using different IP's from place to place?

If you don't need global access to the sensitive parts, there is nothing to do.

Maybe the only part which makes sense to put out of the security concept is phpmyadmin, so that you can create new databases for development. Here is a desciption for that (but: just make these changes if you really really need phpmyadmin access from outside - more security is always more security :) ):
- Give MySQL Users "root" a secure password - important for script security
- Delete the MySQL Users "Any" - they are not needed.
- Create a new administrative MySQL user for Host % (Any Host), with all needed global priviledges and a really really secure password (!!!)
- and restart MySQL
- Open \xampp\phpMyAdmin\config.inc.php
Code: Select all
Search the line
$cfg['Servers'][$i]['auth_type'] = 'config';

Replace with
$cfg['Servers'][$i]['auth_type'] = 'cookie';

- and save the file
- open \xampp\apache\conf\extra\httpd-xampp.conf
Code: Select all
Search the line
<LocationMatch "^/(?i:(?:xampp|licenses|phpmyadmin|webalizer|server-status|server-info))">

Replace with
<LocationMatch "^/(?i:(?:xampp|licenses|webalizer|server-status|server-info))">

- save the file and restart Apache

puttsy wrote:Is there an add-on or program I can use to require logging into any of my content? Say, I type in: wiki.mydomain.com and receive the "Authentication Required" dialog/window as soon as I connect to that site?

Thats possible with .htaccess authorization, but as said before, your own subfolders inside htdocs are not by default protected by the new security concept. Sure, you can improve your own script security with such a .htaccess authorization, if you want to.

best wishes,
Altrea
We don't provide any support via personal channels like PM, email, Skype, TeamViewer!

It's like porn for programmers 8)
User avatar
Altrea
AF Moderator
 
Posts: 8294
Joined: 17. August 2009 13:05
XAMPP version: several
Operating System: Windows 10 Pro x64

Re: Can't access sub-domains local or www

Postby puttsy » 31. December 2011 21:17

Thanks Altera. Makes quite a bit of sense now. I'll take a look at Zend for migration to a SMB server but, for what I'm working on now, xampp is pretty nice on a sudo-server (pseudo as in partial, not as in linux) for testing (it's whole purpose seemingly) Thanks for the tons of help guys. It really is amazing. I'll try and close up the major security issues with xampp and keep using it for testing and such but, thanks for all the info and hopefully we can meet up sometime on the Zend forums.

Thanks Sharley for the TONS of help you provide on the forums. It's quite amazing!
puttsy
 
Posts: 6
Joined: 24. December 2011 09:21
Operating System: Windows 7 Pro x64


Return to XAMPP for Windows

Who is online

Users browsing this forum: No registered users and 44 guests