httpd error (98)Address already in use
I have not been able to fix this problem with a web-server installed on a Fedora 9 machine inside a LAN. I first installed httpd with the purpose of publishing a blog using Wordpress, all inside our LAN. I had everything working, httpd, MySQL and was about to install Wordpress, but I had to let it sit and do other work for a few days. In the following days I noticed that at boot time httpd was returning the following error:
Starting httpd: (98)Address already in use: make_sock: could not bind to address 192.168.2.101:80
no listening sockets available, shutting down
Unable to open logs
I've updated my system with bug fixes and updates a few times after I had the server running, but I am the only user of the machine.
After Googling to find answers I've come up with posts all the way to "you may have a rootkit using your port 80". So I've ran ClamAV, rkhunter, and chkrootkit, and all seems well (i.e. no rootkits).
Output from ps aux shows:
# ps aux | grep http | grep -v grep
nino 3189 0.0 0.0 72832 1824 ? Ss 09:02 0:00 /usr/sbin/httpd -f /usr/share/gnome-user-share/dav_user.conf -C Listen 38870
nino 3190 0.0 0.0 72832 1244 ? S 09:02 0:00 /usr/sbin/httpd -f /usr/share/gnome-user-share/dav_user.conf -C Listen 38870
I'm not sure what these processes are doing ...but if I kill them I still get the same error (98) when I try:
# /sbin/service httpd restart
Another "diagnostic" output:
# /usr/sbin/lsof -i | grep http
httpd 3189 nino 3u IPv6 23010 TCP *:38870 (LISTEN)
httpd 3190 nino 3u IPv6 23010 TCP *:38870 (LISTEN)
evolution 3328 nino 22u IPv4 25377 TCP 192.168.2.101:57180->post.mac.com:http (CLOSE_WAIT)
evolution 3328 nino 26u IPv4 25378 TCP 192.168.2.101:57181->post.mac.com:http (CLOSE_WAIT)
python 6209 root 6u IPv4 35268 TCP 192.168.2.101:54367->less.cogeco.net:http (CLOSE_WAIT)
python 6209 root 8u IPv4 35278 TCP 192.168.2.101:41296->18.104.22.168:http (CLOSE_WAIT)
python 6209 root 12u IPv4 35286 TCP 192.168.2.101:58586->22.214.171.124:http (CLOSE_WAIT)
...and the output from #netstat -lnp is include in the attached text file.
One post I found mentioned a rootkit had actually replaced netstat...
I also have the MySQL server start-up at boot, but even after "killing" it I get the same httpd error.
Any help would be GREATLY appreciated. I am fairly new to Linux and no-where near knowing enough...