Forum

Hi Hugo,

I have created a 404.php page

ErrorHandler = 404:/404.php

if I type mydomain.com/fred or mydomain.com/fred.html I do get my custom page:) but if I type mydomain.com/fred.shtml I get the error

No input file specified. 

..
The website use ssi mainly so I'm not sure how to solved this issue
Here is the file

VirtualHost {
 Hostname = www.mydomain.co.uk, mydomain.co.uk
 EnforceFirstHostname = yes
 WebsiteRoot = /usr/local/www/production/httpdocs
 StartFile = index.shtml
 UseLocalConfig = yes                           # Tell Hiawatha to use or ignore .hiawatha files
 CustomHeader = X-Frame-Options: sameorigin
 CustomHeader = Vary: Accept-Encoding
 AccessLogfile = /usr/local/www/production/httpdocs/www_old/logs/access.mydomain.co.uk.log
 ErrorLogfile = /usr/local/www/production/httpdocs/www_old/logs/error.mydomain.co.uk.log
 TimeForCGI = 15
 UseFastCGI = PHP5_SHTML
 ExecuteCGI = yes                               # Allow execution of CGI programs.
                                                # Default = no
ErrorHandler = 404:/404.php


################ Security Settings #################################

 DenyBody = ^.*%3Cscript.*%3C%2Fscript%3E.*$    # If the request body matches the case insensitive regular expression, return a 403 Forbidden

 PreventSQLi = yes                              # Prevent SQL-injection by detecting injections and denying the request via a 403, 404 or 441 response.
                                                # NOT 100% guarantee, resource intensive!

 PreventXSS = yes                               # Prevent cross-site scripting via the URL by replacing a less-then, greater-then, quote or double-quote in the URL with an underscore.
                                                # Default = no
 #WrapCGI = jail_mydomain.co.uk
}

thank you

Do you have a CGIhandler set for .shtml files?

Hi Hugo,
I beleave that I do.. here is my hiawatha.conf file under the section Common Gateway Interface Settings

################ Set Variables #####################################
# variables are case-sensitive and cannot be re-declared.
#
 set LOCALHOST = 127.0.0.0/8
 set MyIPv4 = 10.8.20.25
 set TrustedIP_1 = 86.19.xx.xxx         # Whitelist office IP Address (red hall drive)
 #set TrustedIP_1 = 62.30.xx.xx
 set TrustedIP_2 = 86.8.75.xxx           # Whitelist Head Office IP Address (stonegate road)
 set TrustedIP_3 = 10.8.20.xx            # WHitelist proxy server IP Address

################ General Settings ##################################
 #MonitorServer = 192.168.1.125                         #  IP address of the Hiawatha Monitor server
 ServerString = Hiawatha
 ServerId = www:www
 HideProxy = 10.8.20.13
 ConnectionsTotal = 4096                                # Maximum number of simultaneous connections. Default = 100
 ConnectionsPerIP = 32                                  # Maximum number of simultaneous connections per IP address. Default = 10
 MaxUrlLength = 1000                                    # Maximum length of the path of an URL that the webserver accepts as being valid
                                                        # Otherwise, a 414 error code is returned
                                                        # Default = 1000
 SystemLogfile = /var/log/hiawatha/system.log
 GarbageLogfile = /var/log/hiawatha/garbage.log
 ExploitLogfile = /var/log/hiawatha/exploit.log         # xss sqli etc
 #ThreadKillRate = 10                                   # Free unused threads
 #CacheSize = 8                                         # Size of Hiawatha's internal file cache. Maximum is 1024 (megabytes). Default = 10
 #CacheMaxFilesize = 512                                # Maximum size of a file Hiawatha will store in its internal cache. Default = 256
 MinTLSversion = 1.2                                    # Specify the minimum TLS version Hiawatha accepts for HTTPS connections
                                                        # Default = 1.1 (last updated 03/09/16)

 DHsize = 4096                                          # Set the size of the Diffie-Hellman key.
                                                        # Default = 2048

 SocketSendTimeout = 30                                 # Sets the SO_SNDTIMEO value for all client connection sockets
                                                        # Default = 3

 ReconnectDelay = 3                                     # How long connection wil stay open after no traffic

### Whitelist business IPs ###
 LogfileMask = deny LOCALHOST, deny MyIPv4, deny TrustedIP_1, deny TrustedIP_2, deny TrustedIP_3

 # This network can upload all they want
 RequestLimitMask = deny LOCALHOST, deny MyIPv4, deny TrustedIP_1, deny TrustedIP_2, deny TrustedIP_3

################ Binding Settings ##################################
 include bindings.conf

################ Banning Settings ##################################
# Deny service to clients who misbehave.

 # NEVER ban whitelisted IP Address
 BanlistMask = deny LOCALHOST, deny MyIPv4, deny TrustedIP_1, deny TrustedIP_2, deny TrustedIP_3
 KickOnBan = yes                                # Close all connections for an IP that is banned
 RebanDuringBan = yes                           # Reset the ban-time when a client tries to reconnect during a ban

 ChallengeClient = 200, httpheader, 60          # Challenge the client to verify that it's a real web browser and not an HTTP bot
 #ChallengeClient = 768, javascript, 15         # After 200 connects send a coockie
 BanOnFlooding = 90/1:15
 BanOnGarbage = 300                             # seconds
 BanOnInvalidURL = 60                           # seconds
 BanOnMaxPerIP = 15                             # seconds
 BanOnMaxReqSize = 300                          # seconds
 BanOnWrongPassword = 3:120                     # seconds
 BanOnSQLi = 3600                               # seconds
 BanOnDeniedBody = 120                          # seconds

################ Common Gateway Interface Settings #################

 CGIhandler = /usr/local/bin/ssi-cgi:shtml
 CGIhandler = /usr/local/bin/php-cgi:php

 FastCGIserver {
         FastCGIid = PHP5-FPM
         ConnectTo = /var/run/php-fpm.sock
         Extension = php
 }

  FastCGIserver {
         FastCGIid = PHP5_SHTML
         ConnectTo = /var/run/php-fpm.sock
         Extension = php, shtml
 }

################ URL Toolkit Settings ##############################
 include toolkit.conf

################ Directory Settings ################################
 include directory.conf

################ default Website Settings ##########################
# protect from automated webscanners
 Hostname = 127.0.0.1
 WebsiteRoot = /usr/local/www/hiawatha
 StartFile = index.html
 AccessLogfile = /var/log/hiawatha/default.access.log
 ErrorLogfile = /var/log/hiawatha/default.error.log
 #ErrorHandler = 404:/error.cgi

################ Vhost Settings ####################################
 include siteconf

You let PHP handle .shtml files? (see FastCGI server with id PHP5_SHTML) Why? Remove shtml from the Extension setting to solve the issue.

Hi Hugo,
Yes we do because the site was written using SSI (.shtml) but we Thwe have shopping cart written in php..so inside the /cart directory we have a .hiawatha file with

StartFile = index.php

If I remove the shtml from the Extension setting, I am no longer able to access the site as the index is index.shtml

But since when is PHP able to handle shtml?? Why let PHP handle shtml files instead of ssi-cgi?

Anyway, you might want to look at TriggerOnCGIstatus. I think that option does what you are looking for.

Hi Hugo,

I used TriggerOnCGIstatus as sugested and I confirm that it resolved my problem

Thank you for your help