httpd error (98)Address already in use

[njaimo]

Hi,

I have not been able to fix this problem with a web-server installed on a Fedora 9 machine inside a LAN. I first installed httpd with the purpose of publishing a blog using Wordpress, all inside our LAN. I had everything working, httpd, MySQL and was about to install Wordpress, but I had to let it sit and do other work for a few days. In the following days I noticed that at boot time httpd was returning the following error:

Starting httpd: (98)Address already in use: make_sock: could not bind to address 192.168.2.101:80
no listening sockets available, shutting down
Unable to open logs

I've updated my system with bug fixes and updates a few times after I had the server running, but I am the only user of the machine.

After Googling to find answers I've come up with posts all the way to "you may have a rootkit using your port 80". So I've ran ClamAV, rkhunter, and chkrootkit, and all seems well (i.e. no rootkits).

Output from ps aux shows:

# ps aux | grep http | grep -v grep
nino 3189 0.0 0.0 72832 1824 ? Ss 09:02 0:00 /usr/sbin/httpd -f /usr/share/gnome-user-share/dav_user.conf -C Listen 38870
nino 3190 0.0 0.0 72832 1244 ? S 09:02 0:00 /usr/sbin/httpd -f /usr/share/gnome-user-share/dav_user.conf -C Listen 38870

I'm not sure what these processes are doing ...but if I kill them I still get the same error (98) when I try:
# /sbin/service httpd restart

Another "diagnostic" output:

# /usr/sbin/lsof -i | grep http
httpd 3189 nino 3u IPv6 23010 TCP *:38870 (LISTEN)
httpd 3190 nino 3u IPv6 23010 TCP *:38870 (LISTEN)
evolution 3328 nino 22u IPv4 25377 TCP 192.168.2.101:57180->post.mac.com:http (CLOSE_WAIT)
evolution 3328 nino 26u IPv4 25378 TCP 192.168.2.101:57181->post.mac.com:http (CLOSE_WAIT)
python 6209 root 6u IPv4 35268 TCP 192.168.2.101:54367->less.cogeco.net:http (CLOSE_WAIT)
python 6209 root 8u IPv4 35278 TCP 192.168.2.101:41296->193.28.235.37:http (CLOSE_WAIT)
python 6209 root 12u IPv4 35286 TCP 192.168.2.101:58586->192.150.18.46:http (CLOSE_WAIT)

...and the output from #netstat -lnp is include in the attached text file.
One post I found mentioned a rootkit had actually replaced netstat...

I also have the MySQL server start-up at boot, but even after "killing" it I get the same httpd error.

Any help would be GREATLY appreciated. I am fairly new to Linux and no-where near knowing enough...

Cheers,

-njaimo

[SteveGYBE]

I tried running

rpm -qfi /usr/share/gnome-user-share/dav_user.conf

And it came back with

Name : gnome-user-share Relocations: (not relocatable)
Version : 0.31 Vendor: Fedora Project
Release : 1.fc9 Build Date: Mon 07 Apr 2008 10:51:35 BST
Install Date: Thu 15 May 2008 18:27:14 BST Build Host: hammer2.fedora.redhat.com
Group : System Environment/Libraries Source RPM: gnome-user-share-0.31-1.fc9.src.rpm
Size : 224013 License: GPLv2+
Signature : DSA/SHA1, Thu 10 Apr 2008 20:02:34 BST, Key ID b44269d04f2a6fd2
Packager : Fedora Project
URL : http://www.gnome.org
Summary : Gnome user file sharing
Description :

gnome-user-share is a small package that binds together various free
software projects to bring easy to use user-level file sharing to the
masses.

The program is meant to run in the background when the user is logged
in, and when file sharing is enabled a webdav server is started that
shares the $HOME/Public folder. The share is then published to all
computers on the local network using mDNS/rendezvous, so that it shows
up in the Network location in GNOME.

The program also allows to share files using ObexFTP over Bluetooth.

So it looks like you are using WebDav to share files on the computer (whether you realised it or not !) and that is using port 80.

[njaimo]

Thanks much for the note! However running #/sbin/services --status-all does not show WebDav, and none of the other diagnostic output showed anything related to port 80, or WebDav. I also looked at System>Administrtation>Services to find WebDav and it is not listed.

To make sure I killed the two processes

nino 3156 0.0 0.0 72832 1824 ? Ss 10:50 0:00 /usr/sbin/httpd -f /usr/share/gnome-user-share/dav_user.conf -C Listen 41104
nino 3157 0.0 0.0 72832 1244 ? S 10:50 0:00 /usr/sbin/httpd -f /usr/share/gnome-user-share/dav_user.conf -C Listen 41104

and then ran #/sbin/service httpd restart and still got the same (98) error, so apparently my port 80 is still tied up...

Am I missing some obvious clues ?

Cheers and thanks again for the suggestion !

-njaimo

[njaimo]

FIXED !

...after a few more hours Googling I found a post mentioning how httpd.conf includes all other .cong files located in ./conf.d, such as system-config-httpd.conf, which is generated by the System>Administration>Server Settings>HTTP applet in my Gnome desktop. Both files have a "Listen" command pointing to port 80, and there lies the issue -- you only need one instance of this command.

The reason this issue had not come up in the beginning was that I had not used the Server Settings applet, and thus no system-config-httpd.conf file had been created causing the conflict.

I've commented the "Listen" commands on the system-config-httpd.conf file, and the "Listen 80" command in http.conf, and added a specific IP line such as 192.168.1.10:80, where the IP is that of my machine where I have the web-server installed.

I rebooted and all is well.

-njaimo