Atomicorp

This latest build I'm working on has no control panel, just varnsh, apache, php-fpm and mariadb 10.1.

The setup is that Varnish listens on port 80 while apache sits behind on another port. I've got the config setup to pass real ip's back to apache so ASL can do it's thing.

The issue I'm facing now is that ASL will sometimes not throw the 403 Forbidden page when it is tripped and instead throw the apache info page, the one which says that Apache has been successfully installed and you need to configure stuff to get it working.

Now, because it doesn't throw the 403 Forbidden message, if someone tries something hinky on the index page of the website this Apache info page get's cached by Varnish and starts showing up for everyone. I have to manually step in and clear Varnish to get the website to load up again.

I understand that this may not be the best way to go about this, but this property does 50M page views a month and I've tried putting T-WAF on port 80 along with NGINX and have experienced TWAF crashes due to the load on the server.

I honestly don't know what to do other than remove ASL from this server, which I really don't want to.

Server:
Varnish 4.0
Apache 2.4
PHP-FPM 5.4
MariaDB 10.1
CentOS 7.1

u need to configure apaches errordocument directive. its going to the default setup page when its not defined