41–47 of 47 posts
You've got to watch this... Apache typically limits this to localhost, but if you use squid as a reverse proxy (quite common) then you can see this easily being exposed since all requests will appear to come from the local machine.
sudo a2dismod status
Example:
Site is down for me, but I thought we agreed last time this was on HN it wasn't really that big of a deal.. Previous discussion: http://news.ycombinator.com/item?id=4661625
Edited: Typo
This can also lead to DOS issues, as I understand it, the Apache server-status pages are very computationally intensive to produce, and it requires stopping and polling every child. Something like SetHandler server-status Order Deny,Allow Deny from all Allow from 10.0.0.0/24 (where 10.0.0.0 is your local network range) will prevent external requests. This is mentioned in the linked through Apache documentation.
Site is down for me, but I thought we agreed last time this was on HN it wasn't really that big of a deal.. Previous discussion: http://news.ycombinator.com/item?id=4661625
Earlier quoted context omitted.
Why is that a big deal? Is exposing the public IPs of some random people really an issue?
Can be an issue. AOL deidentifed search data still allowed some people to be identified. When name is tied to some medical condition related search terms, it gets embarrassing...
Yesterday it was returning IP address list with associated medical condition of interest...