1

I have a server running Ubuntu 20.04.3 LTS (Focal Fossa). It is at IP address 192.168.1.12

When I use a web browser to access 192.168.1.12, a NextCloud login appears. This is all well and good except that I have not (purposely) installed NextCloud. When I connect to port 80 using telnet:

When I connect to the server via telnet on port 80 for more information:

> telnet 192.168.1.12 80
Trying 192.168.1.12...
Connected to 192.168.1.12.
Escape character is '^]'.
head / http/1.0
HTTP/1.1 400 Bad Request
Date: Mon, 14 Mar 2022 17:24:15 GMT
Server: Apache
Content-Length: 226
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
</p>
</body></html>
Connection closed by foreign host.

When I run apt list --installed, there is no reference to nextcloud and no reference to apache:

> apt list --installed | egrep -i 'apache|next'

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

dennis@r2d2:/etc/init.d   03/14 13:26:49

Looking in /etc I don't see any folder named apache2 (or similar) and no folder named similarly to nextcloud.

So I'm confused as to how this is all working. How can I identify the location of the webserver and begin taking control of what it offers?

lsof (thanks, @djdomi) shows the following:

root@r2d2:~# netstat -anp | grep apache
root@r2d2:~# lsof -i :80
COMMAND       PID USER   FD   TYPE    DEVICE SIZE/OFF NODE NAME
Plex\x20M     834 plex   62u  IPv4 158905392      0t0  TCP r2d2.lovelady.com:56860->ec2-52-16-11-44.eu-west-1.compute.amazonaws.com:http (CLOSE_WAIT)
Plex\x20T    1670 plex   75u  IPv4     32467      0t0  TCP r2d2.lovelady.com:50452->ec2-18-203-176-12.eu-west-1.compute.amazonaws.com:http (CLOSE_WAIT)
httpd     1358151 root    3u  IPv4 157704069      0t0  TCP *:http (LISTEN)
httpd     1358153 root    3u  IPv4 157704069      0t0  TCP *:http (LISTEN)
httpd     1358154 root    3u  IPv4 157704069      0t0  TCP *:http (LISTEN)
httpd     1358155 root    3u  IPv4 157704069      0t0  TCP *:http (LISTEN)
httpd     2958297 root    3u  IPv4 157704069      0t0  TCP *:http (LISTEN)

Again thanks to @djdomi I ran the following command; looks like Plex may be the culprit I'm looking for, but still no real answer to the original question:

root@r2d2:/etc/init.d# ps auxwww |egrep '834|1670'
plex         834  0.2  0.3 118780 75268 ?        Ssl  Jan31 131:48 /usr/lib/plexmediaserver/Plex Media Server
plex        1670  0.0  0.0  42192 12528 ?        Sl   Jan31  51:51 /usr/lib/plexmediaserver/Plex Tuner Service /usr/lib/plexmediaserver/Resources/Tuner/Private /usr/lib/plexmediaserver/Resources/Tuner/Shared 1.24.2.4973-2b1b51db9 32600

The paths shown just contain a bunch of .ini files.

Improve this question
11
  • you may want to use lsof -i :80 remind that it can aldo run as a container like socker or lxc
    – djdomi
    Commented Mar 14, 2022 at 17:48
  • Thanks @djdomi - lsof (when logged in as root) returns several lines - among them are references to Plex\x20M and Plex\x20T ... but nothing that helps me understand the location of Apache. I've added the results to the question.
    – Dennis
    Commented Mar 14, 2022 at 17:56
  • look for pid 834,1670 you can use ps auxwww for it
    – djdomi
    Commented Mar 14, 2022 at 18:02
  • Thanks again @djdomi - updated again.
    – Dennis
    Commented Mar 14, 2022 at 18:10
  • dennis, how many hints do you need more? :P use apt now for this. This site is for Professional Users. Some help to identify a problem but you should be able to identify a program that is installed. remins that apt-file is also a nice helper ;)
    – djdomi
    Commented Mar 14, 2022 at 18:13

0

Reset to default

Browse other questions tagged .