I am in the process of setting up a Sitecore CMS on a Windows 2008 server and I have it mostly setup but the web address to my local on the computer is giving me a 500 error.
When I look at the configurations the site is using, it's trying to reach the web.config file through an odd path
\\\?\C:\inept\siteproject\web.config
I am curious about the \\\?\ is that correct or did I miss a setting? I am not even sure if the configuration is able to access the web.config file either.
I went through the docs in Sitecore and followed a speedy video tut on installing it and so far this odd root file path is the only thing I can think of as being wrong.
Appreciate the help
Ben
Not sure about the path but the error typically means you have a bad web.config. Try going into iis, select the site node and try opening any of the settings (default document etc.). This will typically give you a more descriptive error message with a line number regarding what's wrong with the config. Also make sure you have the correct path set as the physical location under basic settings in iis.
Related
I am just about to go live with a website and am addressing security issues. The site has been public for some time but not linked to the search engines.
I log all incoming requests and today noticed this one:
GET /home/XXXXX/code/repositories/YYYYY-website/templates
where XXXXX is a sudo user on my server and YYYYY is my company name.
This is actually the structure of my Django project code.
My website is coded using Django and runs under Apache2 on Ubuntu.
My question is how can this guy possibly know the underlying code/directory structure on my server, in order to create this request?
Their IP is : 66.249.65.221.
They come up as 100% a hacker on https://ip-46.com
Any contributions welcome.
EDIT1 25/11/2019
With some helpful input from Loïc, I have done some investigation.
The Ubuntu 18.04 server is locked down as far as logging in goes - you can only get in with one of my private keys. The PostgreSQL is locked down - it will only accept connections from one IP where my dev machines reside. RabbitMQ is locked down - it won't accept ANY external incoming connections. The robots.txt allows all crawling but the robots meta restricts access to about 12 pages only.
Somebody who knows Django, would know how to form this directory path if they knew the Django project directory but they also have this relative to root on the server. The only place where this is available is in the Apache2 config file. Obviously Apache needs to know where to pick up the Django web server.
I am 99% sure that this 'hacker' got this via some sort of command to Apache. Everything is redirected to port 443 https. The above GET request doesn't actually do anything because the url doesn't exist.
So to make the question more refined. How can a hacker pull my Django absolute project path from my Apache2 config file?
There are a lot of different ways to learn about the directory structure of a given server.
The easiest usually being error logs;
If in your django settings, DEBUG is set to True, it is very easy for an attacker to get the directory structure of your project.
Then there is LFI, a security issue allowing an attacker to read local files. It's then possible to read some logs, or apache configuration to learn what is your project directory...
The problem could come from another service running on your server as well...
One cannot really give you a complete answer on this topic, as there are a lot of different ways this could happen.
I have an IIS site on a Windows 2012 R2 server. The site has an Application inside it:
The URL for this site is setup on our Active Directive servers as it is only accessible internally from our company. The URL follows the following structure:
http://NAMEoftheSERVICE.myCompanyServices.myCompany.local
The service for this site is placed in an internal folder:
http://NAMEoftheSERVICE.myCompanyServices.myCompany.local/InternalFolder/Service.svc
I have placed a number of test files both at the root level and in the internal folder:
http://NAMEoftheSERVICE.myCompanyServices.myCompany.local/HelloWorld.html
http://NAMEoftheSERVICE.myCompanyServices.myCompany.local/InternalFolder/HelloWorld.html
I can browse these files without any problems. However, I cannot browse the service at http://NAMEoftheSERVICE.myCompanyServices.myCompany.local/InternalFolder/Service.svc
The browser returns
However the file is there, and I have made sure there are no typos in the URL I put in the browser.
I have looked at similar questions but there seems not to be anything like the problem I am experiencing. The only question that looked promising was:
WCF service file not visible
But the answer for that post does not apply to my issue as I already have the configuration mentioned in that post setup as it is suggested.
I have checked the IIS-level config files for any exclusion regarding .svc files or anything similar, but could not find anyhting.
Have you got any suggestions on where to look at to solve this issue?
Solution: Install HTTP Activation feature
After running some more testing on other sites on the same server, I actually realised that the issue was specific to .svc files. I therefore made another search on Google and found that the server was missing the "HTTP Activation" feature (part of the WCF Services).
So, if you are having the same issue on .svc files follow the following steps to make sure you have the right components installed on the server:
Open Server Manager
In Server Manager, click the Manage menu, and then click Add Roles
and Features
In the Add Roles and Features wizard, click Next. Select the
installation type and click Next. Select the destination server and
click Next.
Skip the Server Roles page.
On the Select features page, expand ".Net Framework 4.5 Features",
expand "WCF Services" and select "HTTP Activation". Click Next.
On the Confirm installation selections page, click Install.
On the Results page, click Close.
The same can be achieved by running the following Powershell command:
Install-WindowsFeature -Name NET-WCF-HTTP-Activation45
This did the trick for me. I hope it can be of help to someone.
I am trying to setup a internal wiki site for project documentation project. I am using roadkill because I have a IIS server and a .net environment.
So the installation instructions aren't much. Unzip the files onto a site directory. Navigate to http://arwiki
Should be that simple, however, I get an error about directory browsing and it looks like there is no MVC mapping in Global.asax. It points to a internal dll so it is hard to determine what I did wrong?
Has anyone setup Roadkill and know what I did incorrectly?
Also there is no tag for roadkill
You can ask for help on the issues board -
https://bitbucket.org/yetanotherchris/roadkill/issues?status=new&status=open
However I can tell you that the problem is most likely that you don't have MVC installed on IIS (if it's Windows Server 2008). You might also need to enable ISAPI filters, they can be turned off.
The ASP.NET web installer contains the MVC bits you need, although Roadkill does come bundled with these.
OK, the documentation says:
If you configure the folder containing FW/1 as a new web root and
browse to it, you'll see an introductory application.
So I created a new site in Windows Vista and pointed it to the Framework 1 bundle.
I've installed CF10, and am able to navigate to http://localhost:8500/CFIDE/administrator/
so I know that's working.
But when I navigate to http://localhost/, it gives me:
Error Summary
HTTP Error 500.0 - Internal Server Error
The page cannot be displayed because an internal server error has occurred.
Requested URL http://localhost:80/
Physical Path C:\inetpub\seancorfield-fw1-9e69741
And trying localhost:8500 goes to C:\ColdFusion10\cfusion\wwwroot
I wrote up a pretty detailed blog post here:
http://blog.bittersweetryan.com/2012/02/changing-webroot-of-coldfusion-zeus.html
It looks like you may not have updated your mapping to the WEB-INF and CFIDE folders.
If you installed it as the built in server then it will be 8500.
If you integrated into IIS then it will be port 80
You may just need to run the web connector tool, you will find it in the start menu.
If that doesnt work, you likely don't have the necessary bits of IIS installed.
created and deployed a Web service application in a virtual directory using IIS 6.1. The client application works fine on the same machine. But it is not working in another machine where the client application is copied manually. Can any one help what went wrong?
In Internet explorer, The XML file is displayed in the same machine. But from other machine, 'Un able to open the page' error occurs.
Suggestions please...
Regards,
Baskaran A.
Did you check your firewall settings? Can you open other pages that are served by the same IIS webserver?
My first 2 guesses would be:
1) Firewall settings, as previously mentioned.
2) The client app has a hard coded path in it somewhere that ought to be a relative path or, perhaps a URL. Something along the lines of 127.0.0.1 or localhost or C:\... within the app or in its configuration file(s).