Mailing List Archive: [mod_backhand-users] small backhand master and workhosres

Hi !

Well, the setup is a bit confusing, but i'll try to explain it at the best:

assume we have 3 boxes, 1 entry box with 2 nics, running 3 apaches - one is the rproxy and
handles all virutal hosts and redirects the traffic to the the two backhand masters on the
same machine (running on the internal nic). one backhand master is responsible for
the scripts and the other is responsible for static content. both backhand masters talk
with the other 2 boxes and distibute the traffic to them.

the other two boxes each have 2 apaches running, one for scripts and the other for static content.

what i want to do is to get the script load off of the entry box and strip down this backhand
server to not be able to process any scripts (because this machine is not as fully blown
as the other two) and to redirect the script traffic only to the other two boxes.

the first step is to use byHostname and redirect the requests only to the other two boxes.
this works of course - as long as the other two boxes are living, but if they are dead the
backhand master tries do this itself and the scripts get out unparsed as text/plain - and
that's of course _not_ what i want :)

so the question is if it's possible to configure backhand that it's returning a 403 Forbidden
(or any other error) in case it is not able to backhand the request to another machine, to be
able to fully block access to the local machine if backhand is not working.

a simple <LocationMatch pattern> denies pattern in any case ....

well, thanks for any ideas,
marcus.

--
________________________________________________________________________
ICAN Internet Services GmbH - www.ican.at Marcus Priesch
Loquaiplatz 12/1, A-1060 Vienna mpriesch@ican.at
Tel: +43(1) 595 41 24/26 Fax: +43(1) 595 41 24/99 ICQ: 56430787

Warning, this is a stream of conscientious message. Several disjoint ideas
are represented. Pick out what seems worthwhile :-)

Marcus Priesch wrote:
> Well, the setup is a bit confusing, but i'll try to explain it at the best:
> [ ... snip ... ]
> what i want to do is to get the script load off of the entry box and strip down this backhand
> server to not be able to process any scripts (because this machine is not as fully blown
> as the other two) and to redirect the script traffic only to the other two boxes.

Okay.

> the first step is to use byHostname and redirect the requests only to the other two boxes.
> this works of course - as long as the other two boxes are living, but if they are dead the
> backhand master tries do this itself and the scripts get out unparsed as text/plain - and
> that's of course _not_ what i want :)

Of course :-)

> so the question is if it's possible to configure backhand that it's returning a 403 Forbidden
> (or any other error) in case it is not able to backhand the request to another machine, to be
> able to fully block access to the local machine if backhand is not working.

Short answer... No. But a longer answer is yes.

You could run a small http server, like mini-httpd or thttpd on 127.0.0.1:8080
and have the front-end machine advertise itself as 127.0.0.1:8080 (using the
MulticastStats 127.0.0.1:8080 <multicastaddress>:<port>[,ttl]).

The set
BackhandSelfRedirect On
in the apache configuration. This means if all else fails, it will still
rediret to itself (which is actually a thttpd server running at
127.0.0.1:8080.)

I do agree that it would make a lot more sense to just have LocationMatch
style restrictions.

Another zany idea is this: Make all of the files permissions so that the
scripts are user/group readable, but not world readable. Make them owned by
group www and run apache a group www on the back-end script servers. Then run
apache as group wwwfront on the front end server. That should do the trick.

--
Theo Schlossnagle
1024D/A8EBCF8F/13BD 8C08 6BE2 629A 527E 2DC2 72C2 AD05 A8EB CF8F
2047R/33131B65/71 F7 95 64 49 76 5D BA 3D 90 B9 9F BE 27 24 E7