[LON-CAPA-admin] Error - Request forbidden

lucasm at ohiou.edu lucasm at ohiou.edu
Sat Mar 25 12:42:04 EST 2006 

Mike,

Thanks - this is really good to know. I'll ask the student. In the 
meantime, I have checked the logs and actually see the 403 response 
heading out from the machine (at least I think that's the interpretation).

The apache access log had the following interactions with the student:


4.225.83.57 - - [24/Mar/2006:22:32:16 -0500] "GET / HTTP/1.1" 200 553 "-" 
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 
1.1.4322)"
4.225.83.57 - - [24/Mar/2006:22:32:18 -0500] "GET /adm/roles HTTP/1.1" 403 
21749 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET 
CLR 1.1.4322)"
4.225.83.57 - - [24/Mar/2006:22:32:28 -0500] "GET /adm/roles HTTP/1.1" 403 
21752 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET 
CLR 1.1.4322)"
4.225.83.57 - - [24/Mar/2006:22:33:26 -0500] "GET / HTTP/1.1" 304 - "-" 
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 
1.1.4322)"
4.225.83.57 - - [24/Mar/2006:22:33:30 -0500] "GET /adm/roles HTTP/1.1" 403 
21589 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET 
CLR 1.1.4322)"

which makes me believe the local system is senidng back the 403 - and it 
looks like a healthy sized page.

I have not found anything unusual in the loncapa logs (any suggestions 
Guy?) except that on each machine it seems to want to set up a connection 
with itself (as well as msul1?):

lonc.log.1:Fri Mar 24 22:32:17 2006 (5759) [oucapa7] [Fri Mar 24 
05:10:04 2006: Parent keeping the flock] CRITICAL: Forking server for 
oucapa7
lonc.log.1:Fri Mar 24 22:32:17 2006 (31271) [oucapa7] [Fri Mar 24 22:32:17 
2006: Connected to oucapa7]  Created connection 1 to host oucapa7
lonc.log.1:Fri Mar 24 22:32:17 2006 (31271) [oucapa7] [Fri Mar 24 22:32:17 
2006: Connected to oucapa7] INFO: Connected to lond version: 
version:$Revision: 1.305.2.1 $
lonc.log.1:Fri Mar 24 22:32:17 2006 (31271) [oucapa7] [Fri Mar 24 22:32:17 
2006: Connected to oucapa7] SUCCESS: Connection 1 to oucapa7 now ready for 
action


lond.log.1:Fri Mar 24 22:32:17 2006 (2237):  Attempting to start child 
(IO::Socket::INET=GLOB(0x9a2e498))
lond.log.1:Fri Mar 24 22:32:17 2006 (31272):  existing host msul1
lond.log.1:Fri Mar 24 22:32:17 2006 (31272): INFO: Connection, 127.0.0.1 
(oucapa7) connection type = client
lond.log.1:Fri Mar 24 22:32:17 2006 (31272): Setting hostid to oucapa7, 
and domain to ohiou
lond.log.1:Fri Mar 24 22:32:17 2006 (31272):
lond.log.1:Fri Mar 24 22:32:17 2006 (31272): Established connection: 
oucapa7
lond.log.1:Fri Mar 24 22:32:17 2006 (31272): Setting hostid to oucapa7, 
and domain to ohiou


Later,
Mark


  On Sat, 25 Mar 2006, Mike Stanger wrote:

> I've dealt with similar issues with spyware on various web apps (ie. not just 
> LON-CAPA, but a number of different ones including WebCT - usually pages with 
> some Javascript that matches "something" that a spyware/etc. package is 
> looking for)  -- The question I'd ask the student at this point is what the 
> URL is where she sees the "error- request forbidden" message - my bet is that 
> it's not your LON-CAPA box or even in your domain -- probably some search 
> engine or advertising link -- and it's probably been taken down because of 
> complaints, hence the request forbidden error...
>
> "PerfectNav" is the name of one of the perpetrators but there are lots of 
> others...   we put up a page on one of our troubleshooting pages for students 
> that has some information on the general problem...
>
> http://www.sfu.ca/webct/logintroubleshooting.htm#Searchsite
>
> Mike
>
> At 10:22 AM -0500 3/25/06, lucasm at ohiou.edu wrote:
>> Hi,
>> 
>> I've got a student having problems with login from home. My guess is that 
>> she has mucked up her browser with spyware, but I was wondering if anyone 
>> else has seen this? She never gets a chance to log in - an error page comes 
>> up.
>> 
>> ---------------------------------------------------------------------------
>> 
>> "I tried all the addresses you gave me and with the capa7 and capa8 
>> addresses, a page that said
>> 
>> "The LearningOnline Network with CAPA
>> Continue"
>> 
>> appeared for a max. of 4 seconds and then went to an error screen that said 
>> "Error -  Request forbidden". This also happened when I tried using the 
>> numerical address. When I used the capa10 address, I immediately received 
>> the "Error -  Request forbidden" message.
>> ---------------------------------------------------------------------------
>> 
>> Is this a familiar syndrome to anyone? Is there an immediate or likely 
>> cause?
>> 
>> Thanks!
>> Mark
>> 
>> 
>> _______________________________________________
>> LON-CAPA-admin mailing list
>> LON-CAPA-admin at mail.lon-capa.org
>> http://mail.lon-capa.org/mailman/listinfo/lon-capa-admin
>
> _______________________________________________
> LON-CAPA-admin mailing list
> LON-CAPA-admin at mail.lon-capa.org
> http://mail.lon-capa.org/mailman/listinfo/lon-capa-admin
>

----------------------------------------------------------------------------
Mark Lucas					email: lucasm at ohiou.edu
252D Clippinger Lab  				phone: (740)597-2984
Department of Physics and Astronomy             fax:   (740)593-0433
Ohio University
Athens, OH 45701

More information about the LON-CAPA-admin mailing list