Renewal fails with login

Help
41

I've been watching access logs and trying to ban dumb/malicious requests. I figured if someone does a GET without returning something valid I mark that as bad request. I don't think that's a dumb idea?

EDIT: Someone reading this and helping got bonked by f2b but it should be fixed now

42

Don't get over zealous banning everything at this point. If it were me, I would disable f2b until I got the cert stuff worked out. Not to tell you what to do or anything like that.... but consider opening up your server for the time being to allow Rudy to help you sort this out.

43

fail2ban-client set addignoreip <Y'allsIP>

Best of both? for now, y'alls addresses won't be filtered. When we sort out what's happening I'll remove the "ignore" status

44

The issue here is that we don't have a list of IP addresses that LE uses for renewals, etc. Totally random. So if your trying to renew a cert and the LE server fails with some bizarre error code you are still stuck. f2b is a GREAT tool and I use it too. But get everything functioning so you can see what is actually happening in the access/error logs... then take steps to block UNWANTED access. (I am not trying to get in the way of a solution).
My 2 cents

45

That someone was me - lol

46

OK, this continues to be a problem:

curl http://theveninskeep.com/.well-known/acme-challenge/Test_File-1234
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
Reason: You're speaking plain HTTP to an SSL-enabled server port.<br />
 Instead use the HTTPS scheme to access this URL, please.<br />
</p>
<hr>
<address>Apache/2.4.41 (Ubuntu) Server at TheveninsKeep.com Port 80</address>
</body></html>

And since F2B also includes 400, those IPs will also be clobbered - without merit.

47

The running files look perfect.

We need to figure out why it returns 400.

48

Should I make the test file you're curling? just so that there's something there to try and get?

49

Please move this file somewhere else:

And let's make a new "test" one, like:

<VirtualHost *:80>
  ServerName TheveninsKeep.com
  DocumentRoot /var/MAKE_A_NEW_PATH
  ErrorLog ${APACHE_LOG_DIR}/error.log
  CustomLog ${APACHE_LOG_DIR}/access.log combined
  <Directory "/var/MAKE_A_NEW_PATH">
    AllowOverride None
    Require all granted
  </Directory>
  RewriteEngine On
  RewriteCond %{REQUEST_URI} !^/.well-known/acme-challenge [NC]
  RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
</VirtualHost>

[replace "/var/MAKE_A_NEW_PATH" with an actual newly created path]

50

It returns 400 not 404; So, I'm not sure that would do anything - but worth exploring...

51

cp TheveninsKeep.com.conf TheveninsKeep.com.conf.works

mkdir /var/www/TheveninsKeep.com/testfile
vi /var/www/TheveninsKeep.com/testfile/TEST.txt

vi TheveninsKeep.com.conf

<VirtualHost *:80>
#ServerAdmin admin@TheveninsKeep.com
ServerName TheveninsKeep.com
DocumentRoot /var/www/TheveninsKeep.com/testfile
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
        #<Directory "/var/www/TheveninsKeep.com/html">
        #       AuthType Basic
        #       AuthName "Restricted Content"
        #       AuthUserFile /var/www/TheveninsKeep.com/passwords
        #       Require valid-user
        #</Directory>
RewriteEngine on
RewriteCond %{REQUEST_URI} !^/.well-known/acme-challenge [NC]
RewriteRule (.*) https://%{SERVER_NAME}%{REQUEST_URI}
</VirtualHost>
52

Replace that with the contents I posted.

Even that TEST.txt file fails:

curl http://theveninskeep.com/TEST.txt
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
Reason: You're speaking plain HTTP to an SSL-enabled server port.<br />
 Instead use the HTTPS scheme to access this URL, please.<br />
</p>
<hr>
<address>Apache/2.4.41 (Ubuntu) Server at TheveninsKeep.com Port 80</address>
</body></html>
53

Updated to add that directory section. I missed it the first time i read.

54

This is telling:
You're speaking plain HTTP to an SSL-enabled server port.

55

I haven't fully read all the posts while I was away. And, I will be away again shortly.

But, I just spun up a new test server with a new IP and I get the same http 400 failure for acme-challenge paths and non-acme URL.

Are you restarting Apache after each change?

And, has anyone looked to see if there are more than 1 Apache's running?

Those are just some thoughts while I was away.

56

Let's have a look at the file:
ports.conf

57

Only one seen.

58

Please show:
find /etc/apache2 -name .htaccess

59 
# cat /etc/apache2/ports.conf
# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default.conf

Listen 80

<IfModule ssl_module>
        Listen 443
</IfModule>

<IfModule mod_gnutls.c>
        Listen 443
</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
60

What about router port forwarding mix up?

It almost seems like we aren't reaching that http VirtualHost