A Quick and Dirty Web Maintenance Page Using .htaccess

November 2, 2019 by Charlie Leave a Comment

Sometimes when working on a web site you need a quick and dirty “This Site is Down” Maintenance page. WordPress or other similar software may have this feature built-in or through a plugin, but sometimes you may need to put up a page while moving files around using ssh or scp/sftp/ftps.

If you use Apache or an Apache compatible web server that uses .htaccess, the easiest way to generate a maintenance page is to combine the deny/allow directives with a custom 403 page which can be written directly in .htaccess. The directives will allow only your IP address to work on and view the web site while everyone else will see the maintenance page.

Single File Web Maintenance Mode

This method requires no php or other separate scripts, and no redirects. Enabling the mode is simple – just remove (maintenance mode) or add (go live) the hash comment from two lines ( 21 and 23 in the example below).

Editing Htaccess File

Follow these simple steps:

Using Winscp, ssh, or other similar utility login to your website server, and open .htaccess file located in your web root.

Add the following lines to the top of the .htaccess file:






order deny,allow 
################################### 
# Begin Maintenance Mode Directives 
##################################### 
# Make sure to put the background image in your document root 
<Files background.jpg> 
order allow,deny 
allow from all 
</Files> 

# Insert Your workstation ip here. Replace XXX.XXX.X.XXX with your ip address 
allow from  XXX.XXX.X.XXX  

# To enter maintenance mode, uncomment the following 2 lines. The second long "ErrorDocument" line contains a full html page compressed together in one line with no carriage returns (it's just being word-wrapped in the below example). 

# deny from all 

# ErrorDocument 403 "<html><header><style> body { font: normal normal 24px/60px Georgia, serif; color: white; background-size: 100%; background-repeat: no-repeat; background-image: url('background.jpg'); background-color: black;}</style></header><body><div style= ' box-shadow: 10px 10px #000000; border: 2px solid black; border-radius: 25px; margin: auto; background: #ff5733; padding: 20px; width: 70%;' > <h2 ><center>Joe's Computer Shop</center></h2> <h3><center>Your Local Computer Fix-It Place</center></h3>This Website is Down for Maintenance. Please come back later.  We are sorry for any inconvenience.</div> <div style= ' box-shadow: 10px 10px #000000; border: 2px solid black; border-radius: 15px; margin-left: 10px; margin-top: 100px; background: #000000; padding: 20px; width: 14%; font: normal 14px Georgia, serif;' > Joe's Computer Shop <br/>123 Main Street</br> New York, NY 11111<br/> 800-888-8888<br/> </div><a style='background-color:black;color:white;text-decoration:none;padding:4px 6px;font-family:-apple-system, BlinkMacSystemFont, &quot;San Francisco&quot;, &quot;Helvetica Neue&quot;, Helvetica, Ubuntu, Roboto, Noto, &quot;Segoe UI&quot;, Arial, sans-serif;font-size:12px;font-weight:bold;line-height:1.2;display:inline-block;border-radius:3px; margin-top: 20px;' href='https://unsplash.com/@herlifeinpixels?utm_medium=referral&amp;utm_campaign=photographer-credit&amp;utm_content=creditBadge' >Hannah Wei</a></body></html>"

order deny,allow

###################################

# Begin Maintenance Mode Directives

#####################################

# Make sure to put the background image in your document root

order allow,deny

allow from all

</Files>

# Insert Your workstation ip here. Replace XXX.XXX.X.XXX with your ip address

allow from XXX.XXX.X.XXX

# To enter maintenance mode, uncomment the following 2 lines. The second long "ErrorDocument" line contains a full html page compressed together in one line with no carriage returns (it's just being word-wrapped in the below example).

# deny from all

# ErrorDocument 403 "<html><header><style> body { font: normal normal 24px/60px Georgia, serif; color: white; background-size: 100%; background-repeat: no-repeat; background-image: url('background.jpg'); background-color: black;}</style></header><body><div style= ' box-shadow: 10px 10px #000000; border: 2px solid black; border-radius: 25px; margin: auto; background: #ff5733; padding: 20px; width: 70%;' > <h2 ><center>Joe's Computer Shop</center></h2> <h3><center>Your Local Computer Fix-It Place</center></h3>This Website is Down for Maintenance. Please come back later. We are sorry for any inconvenience.</div> <div style= ' box-shadow: 10px 10px #000000; border: 2px solid black; border-radius: 15px; margin-left: 10px; margin-top: 100px; background: #000000; padding: 20px; width: 14%; font: normal 14px Georgia, serif;' > Joe's Computer Shop <br/>123 Main Street</br> New York, NY 11111<br/> 800-888-8888<br/> </div><a style='background-color:black;color:white;text-decoration:none;padding:4px 6px;font-family:-apple-system, BlinkMacSystemFont, "San Francisco", "Helvetica Neue", Helvetica, Ubuntu, Roboto, Noto, "Segoe UI", Arial, sans-serif;font-size:12px;font-weight:bold;line-height:1.2;display:inline-block;border-radius:3px; margin-top: 20px;' href='https://unsplash.com/@herlifeinpixels?utm_medium=referral&utm_campaign=photographer-credit&utm_content=creditBadge' >Hannah Wei</a></body></html>"

Ask Google “What is my ip address ?“. This is your workstation ip address, select and copy it.
Replace XXX.XXX.XX.XXX with the IP address you copied in the prior step.
Edit the example to put in your own html code and save whatever picture you’d like to use as your background as “background.jpg” in your web root. Make sure any quotes on the ErrorDocument line (line 23 in the example) are single quotes except the outer ones. Also the entire ErrorDocument line should all be on one line with no carriage returns (it will be displayed in the example as multiple lines but that’s just the presentation for this post, the code itself is all one line).
Save the .htaccess file.
That’s it. To enable maintenance mode, uncomment line 21 “deny from all” and line 23 “ErrorDocument 403”. To disable maintenance mode and go “live” comment those same two lines out.
Note that if you get an “Internal Server” error you have a syntax error in your .htaccess file. Fix and try again.

Raspberry Pi and Lighttpd

September 17, 2017 by Charlie Leave a Comment

I’m familiar with apache but not lighttpd. There is very little I could find on how to setup lighttpd with ssl. I don’t have time todo a full blog post but here’s my example lighttpd.conf file for those of you who it might help. It has 2 virtual servers both using ssl. It does not listen on port 80 (non-ssl) at all.







#server.bind = ""
#this is to make sure that it doesn't listent to port 80 port 585 is used by ssl below
server.port = 585 #THIS IS THE PORT THE SERVER IS LISTENING ON, you can change this to any available port
server.tag ="lighttpd"
fastcgi.debug = 1
server.modules = (
        "mod_access",
        "mod_alias",
        "mod_accesslog",
        "mod_compress",
        "mod_expire",
        "mod_redirect",
        "mod_rewrite",
        "mod_fastcgi"
        
)

mimetype.assign   = ( ".png"  => "image/png",
                      ".jpg"  => "image/jpeg",
                      ".jpeg" => "image/jpeg",
                      ".html" => "text/html",
					  ".htm" => "text/html",
                      ".txt"  => "text/plain" )

$HTTP["host"] =~ "Subdomain1\.duckdns\.org" { #CHANGE Subdomain1YOUR DUCKDNS SUBDOMAIN

server.document-root = "/var/www/hal8000"
server.errorlog = "/var/log/lighttpd/Subdomain1/error.log"
index-file.names = ( "index.php", "index.py", "index.html", "index.htm" )
accesslog.filename = "/var/log/lighttpd/Subdomain2/access.log"
server.error-handler-404 = "/e404.php"

compress.filetype = ( "text/plain", "text/html", "text/css", "text/xml", "text/x-js", "text/javascript", "application/x-javascript", "application/javascript" )
}

$HTTP["host"] =~ "Subdomain2\.duckdns\.org" {

server.document-root = "/var/www/smilez"
server.errorlog = "/var/log/lighttpd/Subdomain2/error.log"
index-file.names = ( "index.php", "index.py", "index.html", "index.htm" )
accesslog.filename = "/var/log/lighttpd/Subdomain2/access.log"
server.error-handler-404 = "/e404.php"

compress.filetype = ( "text/plain", "text/html", "text/css", "text/xml", "text/x-js", "text/javascript", "application/x-javascript", "application/javascript" )
}
# You would uncomment this if only want ssl if he socket is 444 this is a condtitional. but we want ssl all the time
#$SERVER["socket"] == ":585" {


     ssl.engine                  = "enable" 
     ssl.pemfile                 = "/etc/letsencrypt/live/Subdomain1.duckdns.org/ssl.pem" 
     ssl.ca-file		 =  "/etc/letsencrypt/live/Subdomain1.duckdns.org/fullchain.pem"
     ssl.dh-file = "/etc/ssl/certs/dhparam.pem" 
     ssl.ec-curve = "secp384r1"
     ssl.honor-cipher-order = "enable"
     ssl.cipher-list = "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"
     ssl.use-compression = "disable"
     setenv.add-response-header = (
    "Strict-Transport-Security" => "max-age=63072000; includeSubdomains; preload",
    "X-Frame-Options" => "DENY",
    "X-Content-Type-Options" => "nosniff"
)
ssl.use-sslv2 = "disable"
ssl.use-sslv3 = "disable"
#} # end ofconditionalwe are not using



server.document-root = "/var/www/html"
index-file.names = ( "index.php", "index.py", "index.html", "index.htm" )

accesslog.filename = "/var/log/lighttpd/access.log"
server.errorlog = "/var/log/lighttpd/error.log"
server.upload-dirs = ( "/var/cache/lighttpd/uploads" )

server.username = "lighttpd"
server.groupname = "lighttpd"
server.pid-file = "/var/run/lighttpd.pid"

## Deny access to the source code of these files:
static-file.exclude-extensions = ( ".php", ".pl", ".py", ".fcgi" )

## Deny access the file-extensions
url.access-deny = ( "~", ".inc" )

## Enable/Disable Directory Listings
dir-listing.encoding = "utf-8"
dir-listing.activate = "disable"
dir-listing.hide-dotfiles = "enable"

## eTags
etag.use-inode = "enable"
etag.use-mtime = "enable"
etag.use-size = "enable"
static-file.etags = "enable"

## Compress module
compress.cache-dir = "/var/cache/lighttpd/compress/"
compress.filetype = ( "text/plain", "text/html", "text/css", "text/xml", "text/x-js", "text/javascript", "application/x-javascript", "application/javascript" )

## Expire Models
$HTTP["url"] =~ "(css|js|png|jpg|ico|gif)$" {
        expire.url = ( "" => "access 7 days" )
}
#expire.url = (
#       "/images/" => "access plus 7 days",
#       "/jquery/" => "access plus 2 weeks",
#       "/js/" => "access plus 2 months",
#       "/misc" => "access plus 1 days",
#       "/themes/" => "access plus 7 days",
#       "/modules/" => "access plus 24 hours"
#)

## Enable PHP
fastcgi.server = ( ".php" => ((
        #"bin-path" => "/usr/bin/php5-cgi",
        "bin-path" => "/usr/bin/php5-cgi",
        "socket" => "/tmp/php.socket"
)))

## Load enabled configuration files
#include_shell "/usr/share/lighttpd/include-conf-enabled.pl"
#include_shell "/usr/local/share/lighttpd/include-sites-enabled.pl"




1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123

#server.bind = ""
#this is to make sure that it doesn't listent to port 80 port 585 is used by ssl below
server.port = 585 #THIS IS THE PORT THE SERVER IS LISTENING ON, you can change this to any available port
server.tag ="lighttpd"
fastcgi.debug = 1
server.modules = (
        "mod_access",
        "mod_alias",
        "mod_accesslog",
        "mod_compress",
        "mod_expire",
        "mod_redirect",
        "mod_rewrite",
        "mod_fastcgi"
        
)
 
mimetype.assign   = ( ".png"  => "image/png",
                      ".jpg"  => "image/jpeg",
                      ".jpeg" => "image/jpeg",
                      ".html" => "text/html",
   ".htm" => "text/html",
                      ".txt"  => "text/plain" )
 
$HTTP["host"] =~ "Subdomain1\.duckdns\.org" { #CHANGE Subdomain1YOUR DUCKDNS SUBDOMAIN
 
server.document-root = "/var/www/hal8000"
server.errorlog = "/var/log/lighttpd/Subdomain1/error.log"
index-file.names = ( "index.php", "index.py", "index.html", "index.htm" )
accesslog.filename = "/var/log/lighttpd/Subdomain2/access.log"
server.error-handler-404 = "/e404.php"
 
compress.filetype = ( "text/plain", "text/html", "text/css", "text/xml", "text/x-js", "text/javascript", "application/x-javascript", "application/javascript" )
}
 
$HTTP["host"] =~ "Subdomain2\.duckdns\.org" {
 
server.document-root = "/var/www/smilez"
server.errorlog = "/var/log/lighttpd/Subdomain2/error.log"
index-file.names = ( "index.php", "index.py", "index.html", "index.htm" )
accesslog.filename = "/var/log/lighttpd/Subdomain2/access.log"
server.error-handler-404 = "/e404.php"
 
compress.filetype = ( "text/plain", "text/html", "text/css", "text/xml", "text/x-js", "text/javascript", "application/x-javascript", "application/javascript" )
}
# You would uncomment this if only want ssl if he socket is 444 this is a condtitional. but we want ssl all the time
#$SERVER["socket"] == ":585" {
 
 
     ssl.engine                  = "enable" 
     ssl.pemfile                 = "/etc/letsencrypt/live/Subdomain1.duckdns.org/ssl.pem" 
     ssl.ca-file =  "/etc/letsencrypt/live/Subdomain1.duckdns.org/fullchain.pem"
     ssl.dh-file = "/etc/ssl/certs/dhparam.pem" 
     ssl.ec-curve = "secp384r1"
     ssl.honor-cipher-order = "enable"
     ssl.cipher-list = "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"
     ssl.use-compression = "disable"
     setenv.add-response-header = (
    "Strict-Transport-Security" => "max-age=63072000; includeSubdomains; preload",
    "X-Frame-Options" => "DENY",
    "X-Content-Type-Options" => "nosniff"
)
ssl.use-sslv2 = "disable"
ssl.use-sslv3 = "disable"
#} # end ofconditionalwe are not using
 
 
 
server.document-root = "/var/www/html"
index-file.names = ( "index.php", "index.py", "index.html", "index.htm" )
 
accesslog.filename = "/var/log/lighttpd/access.log"
server.errorlog = "/var/log/lighttpd/error.log"
server.upload-dirs = ( "/var/cache/lighttpd/uploads" )
 
server.username = "lighttpd"
server.groupname = "lighttpd"
server.pid-file = "/var/run/lighttpd.pid"
 
## Deny access to the source code of these files:
static-file.exclude-extensions = ( ".php", ".pl", ".py", ".fcgi" )
 
## Deny access the file-extensions
url.access-deny = ( "~", ".inc" )
 
## Enable/Disable Directory Listings
dir-listing.encoding = "utf-8"
dir-listing.activate = "disable"
dir-listing.hide-dotfiles = "enable"
 
## eTags
etag.use-inode = "enable"
etag.use-mtime = "enable"
etag.use-size = "enable"
static-file.etags = "enable"
 
## Compress module
compress.cache-dir = "/var/cache/lighttpd/compress/"
compress.filetype = ( "text/plain", "text/html", "text/css", "text/xml", "text/x-js", "text/javascript", "application/x-javascript", "application/javascript" )
 
## Expire Models
$HTTP["url"] =~ "(css|js|png|jpg|ico|gif)$" {
        expire.url = ( "" => "access 7 days" )
}
#expire.url = (
#       "/images/" => "access plus 7 days",
#       "/jquery/" => "access plus 2 weeks",
#       "/js/" => "access plus 2 months",
#       "/misc" => "access plus 1 days",
#       "/themes/" => "access plus 7 days",
#       "/modules/" => "access plus 24 hours"
#)
 
## Enable PHP
fastcgi.server = ( ".php" => ((
        #"bin-path" => "/usr/bin/php5-cgi",
        "bin-path" => "/usr/bin/php5-cgi",
        "socket" => "/tmp/php.socket"
)))
 
## Load enabled configuration files
#include_shell "/usr/share/lighttpd/include-conf-enabled.pl"
#include_shell "/usr/local/share/lighttpd/include-sites-enabled.pl"

I also followed this tutorial from the Nwgat blog to setup letsencrypt ssl certificates (the only one I could find that worked for me). I’m copying the steps below in case that link goes dead:

https://nwgat.ninja/setting-up-letsencrypt-with-lighttpd/

Stop lighttpd







sudo service lighttpd stop

<li>then run letsencrypt client</li>

 
<pre class="lang:default decode:true " >

    git clone https://github.com/letsencrypt/letsencrypt && cd letsencrypt
    ./letsencrypt-auto --agree-dev-preview --server \
      https://acme-v01.api.letsencrypt.org/directory auth




1
2
3
4
5
6
7
8
9
10

sudo service lighttpd stop
 
<li>then run letsencrypt client</li>
 
 
<pre class="lang:default decode:true " >
 
    git clone https://github.com/letsencrypt/letsencrypt && cd letsencrypt
    ./letsencrypt-auto --agree-dev-preview --server \
      https://acme-v01.api.letsencrypt.org/directory auth

combine files into ssl.pem







    sudo su (login as root)
    cd /etc/letsencrypt/live/yourdomain
    cat privkey.pem cert.pem > ssl.pem




1
2
3

    sudo su (login as root)
    cd /etc/letsencrypt/live/yourdomain
    cat privkey.pem cert.pem > ssl.pem

Forward Secrecy & Diffie Hellman Ephemeral Parameters







    cd /etc/ssl/certs
    openssl dhparam -out dhparam.pem 4096




1
2

    cd /etc/ssl/certs
    openssl dhparam -out dhparam.pem 4096

Copy and paste the following into /etc/lighttpd/lighttpd.conf dont forget to change yourdomain to your domain
or you can put it into /etc/lighttpd/conf-enabled as letsencrypt.yourdomain.conf

$SERVER["socket"] == ":443" {
     ssl.engine                  = "enable" 
     ssl.pemfile                 = "/etc/letsencrypt/live/yourdomain/ssl.pem" 
     ssl.ca-file		 =  "/etc/letsencrypt/live/yourdomain/fullchain.pem"
     ssl.dh-file = "/etc/ssl/certs/dhparam.pem" 
     ssl.ec-curve = "secp384r1"
     ssl.honor-cipher-order = "enable"
     ssl.cipher-list = "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"
     ssl.use-compression = "disable"
     setenv.add-response-header = (
    "Strict-Transport-Security" => "max-age=63072000; includeSubdomains; preload",
    "X-Frame-Options" => "DENY",
    "X-Content-Type-Options" => "nosniff"
)
ssl.use-sslv2 = "disable"
ssl.use-sslv3 = "disable"
}

$SERVER["socket"] == ":443" {

ssl.engine = "enable"

ssl.pemfile = "/etc/letsencrypt/live/yourdomain/ssl.pem"

ssl.ca-file = "/etc/letsencrypt/live/yourdomain/fullchain.pem"

ssl.dh-file = "/etc/ssl/certs/dhparam.pem"

ssl.ec-curve = "secp384r1"

ssl.honor-cipher-order = "enable"

ssl.cipher-list = "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"

ssl.use-compression = "disable"

setenv.add-response-header = (

"Strict-Transport-Security" => "max-age=63072000; includeSubdomains; preload",

"X-Frame-Options" => "DENY",

"X-Content-Type-Options" => "nosniff"

)

ssl.use-sslv2 = "disable"

ssl.use-sslv3 = "disable"

}

now open port and start lighttpd

sudo ufw allow 443 sudo service lighttpd start

Port Forwarding Http/Https to Different Computers Within Your Home Network

September 17, 2017 by Charlie Leave a Comment

So you want to have different web servers on your home network that are exposed to the outside world? How do you do that? Most web servers listen on the same ports: 80 for non-ssl and port 443 for ssl. If a request comes in for port 80

Say your home network is setup like this:

Home Network Computers

Router: 192.168.1.1

Your Study: 192.168.1.2 (running your personal wordpress blog )

Wife’s Office: 192.168.1.2 (running your personal wordpress blog)

Living Room Computer: 192.168.1.3 (Running Home Assistant web server)

1. Setup a dynamic DNS service.

Go to duckdns.org (super simple) to create a subdomain url for each computer you’d like to access in your internal network from any computer in the world. I won’t explain it here as the DuckDNS site does a good job. In my example you would need to set up 3 subdomains for your home network:

Example Dynamic DNS URLs

http://blog.duckdns.org -> your blog in your study

http://wifesblog.duckdns.org -> wife’s blog in her office

http://homey.duckdns.org -> home automation server at

2. Setup Port Forwarding

Normally, if you are outside your home network, say at a coffee shop, and plug “http://homey.duckdns.org” in your browser you most likely will end up either with blank page/unauthorized page or will get the control panel login for your router which is at 192.168.1.1.

To set-up port forwarding within your home network go into your router (192.168.1.1 in my example) and navigate to the port forwarding section. I use ddwrt so in my home network I would selecte DD-WRT’s NAT/QoS menu selection and set the port forwarding as follows:

Port From (incoming set by url, e.g.: http://blog.duckdns.org:202)	Ip Address	Port To (This is port server is listening on)
80	192.168.1.1	804 (fake port, nothing is listening here)
202	192.168.1.2	80
203	192.168.1.3	80
204	192.168.1.4	8123

Here’s a screen shot of my example setup:

Once Saved, you access your sites as follows:

URL -> Server

http://blog.duckdns.org:202 -> your blog in your study at 192.168.1.2 port 80

http://wifesblog.duckdns.org:203 -> wife’s blog in her office at 192.168.1.3 port 80

http://homey.duckdns.org:204 -> home automation server at 192.168.1.4 port 8123

If someone leaves the port out (http://blog.duckdns.org) it would just go to a blank page because it would be forwarded to 192.168.1.1:804 which is a fake port with nothing listening.

In actual practice you should use SSL for each of these,but for simplicity of explanation I’ve left that out. However, it would work the same way. You would turn off port 80 on each of the servers, and substitue 443 for 80 above, with an additional fake port for 443, such as the following:

Port From (incoming set by url, e.g.: http://blog.duckdns.org:202)	Ip Address	Port To (This is port server is listening on)
443	192.168.1.1	804 (fake port, nothing is listening here)
202	192.168.1.2	443
203	192.168.1.3	443
204	192.168.1.4	8123

Also, if you’re using ssl you’ll need to set up ssl certificates (use LetsEncryptfor free ssl certifices)

As a final note, you could have all of these sites on one computer (personally I’m doing this on Raspberry Pi 3 using lighttpd and homeassistent), but you would have to change the default listening ports on each server that is running. For example, instead of your blog’s server software listening to 443, you would have the ssl port listen to say 452. Likewise, your wife’s ssl port would listen to say 574, etc. .

geekvisit.com

Hacks, Tutorials, Tips and Tricks for Windows and Linux Enthusiasts

Web Development

A Quick and Dirty Web Maintenance Page Using .htaccess

Single File Web Maintenance Mode

Editing Htaccess File

Raspberry Pi and Lighttpd

Port Forwarding Http/Https to Different Computers Within Your Home Network

1. Setup a dynamic DNS service.

2. Setup Port Forwarding

Archives

Unclutter Your GMail Without Missing Out On Your Newsletters

Windows Reinstall: Use Secret Migration Tool to Restore All Settings Even If Option Disabled; Plus Tips to Restore Programs After a Clean Install

Pi-hole & Unlimited Whitelist for OpenDNS, Cleanbrowsing, Etc.