jeudi 15 janvier 2015

Unknown cause for redirect on 80 port


I have an Ubuntu 14.04 server with Apache 2.4.7 running there, hosting one site on 80 port. Today I discovered that every request to 80 port redirects to another website with response:



HTTP/1.1 301 Moved Permanently
Server: nginx/1.6.2
Date: Thu, 15 Jan 2015 13:37:18 GMT
Content-Type: text/html
Content-Length: 184
Connection: keep-alive
Location: some.website.com


I don't have nginx installed, bit still searched for a nginx process with ps ax | grep nginx command with one result: 25759 pts/1 S+ 0:00 grep --color=auto nginx. It didn't seem like the offending process but still: kill 25759 yielded -bash: kill: (25759) - No such process


Next, I stopped apache (it changed nothing about redirects), and decided to see, who listens to 80 port with the command lsof -i :80 | grep LISTEN which told me nothing, and if I list all listeners with the command: lsof -i | grep LISTEN I get the following list:



sshd 673 root 3u IPv4 7078 0t0 TCP *:ssh (LISTEN)
tinyproxy 972 root 0u IPv4 7654 0t0 TCP *:9582 (LISTEN)
Xtightvnc 1173 root 0u IPv4 7914 0t0 TCP *:x11-1 (LISTEN)


All of which are known entities. If I start apache the following line is also there:



apache2 25926 root 4u IPv6 139312 0t0 TCP *:http (LISTEN)


Next I thought about iptables, but iptables -L shows empty list:



Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination


So, the question is how do I find what causes this redirect (checked from several different computers with different internet providers) and remove it?



Aucun commentaire:

Enregistrer un commentaire