Saturday, August 8, 2020

List all active virtualhosts of apache in Linux

If you want to list all virtualhosts of apache in Linux, here is the command

sudo apache2ctl -S

It will list all the active virtualhosts with port number. You can track easily which hosts are running on port 80 and which hosts are ssl enabled and running on port 443. 

It shows the confguration file path with name of the virtualhost, it helps user to do the required modifications.

`apache2ctl -S` is better than a2query command as it finds all the active virtualhosts in all apache config files whether it is sites-enabled or some other files.

If a virtualhost is hidden in the non-default config files, it can be easily found using above command.

Now how can you hide a apache virtualhost ?

Apache config files have preferences. If a virtual host is created in sites-enabled config file and same virtualhost with same ServerName but different DocumentRoot is created in mods-enabled config file, mods-enabled config file virtualhost will be activated as mods-enabled config file has higher preference over sites-enabled config file because its Includeoptional entry appears first in the file apache2.conf.

So if you create a virtualhost in the file /usr/src/core/base.conf and include this file at the end in the file /etc/apache2/mods-enabled/proxy.conf

IncludeOptional ../../usr/src/core/*.conf

and same virtualhost with same ServerName but different DocumentRoot is created in regular virtualhost file sites-enabled/000-default.conf, it will be hard to detect the actual virtualhost conf file location and DocumentRoot path of the project without using command `apache2ctl -S`

This was just one example, it can be created in more complex way to hide the virtualhosts and project directory path to show you the wrong application directory. It may amaze you why your project changes are not reflected or while taking backup, you can take backup of wrong directory if you are not careful enough.

That's why you should be updated with all apache tricks so no one can fool you while handing over the project.


No comments:

Post a Comment