I have a server running Ubuntu 20.04.3 LTS (Focal Fossa). It is at IP address 192.168.1.12
When I use a web browser to access 192.168.1.12, a NextCloud login appears. This is all well and good except that I have not (purposely) installed NextCloud. When I connect to port 80 using telnet:
When I connect to the server via telnet on port 80 for more information:
> telnet 192.168.1.12 80
Trying 192.168.1.12...
Connected to 192.168.1.12.
Escape character is '^]'.
head / http/1.0
HTTP/1.1 400 Bad Request
Date: Mon, 14 Mar 2022 17:24:15 GMT
Server: Apache
Content-Length: 226
Connection: close
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
</p>
</body></html>
Connection closed by foreign host.
When I run apt list --installed, there is no reference to nextcloud and no reference to apache:
> apt list --installed | egrep -i 'apache|next'
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.
dennis@r2d2:/etc/init.d 03/14 13:26:49
Looking in /etc I don't see any folder named apache2 (or similar) and no folder named similarly to nextcloud.
So I'm confused as to how this is all working. How can I identify the location of the webserver and begin taking control of what it offers?
lsof (thanks, @djdomi) shows the following:
root@r2d2:~# netstat -anp | grep apache
root@r2d2:~# lsof -i :80
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
Plex\x20M 834 plex 62u IPv4 158905392 0t0 TCP r2d2.lovelady.com:56860->ec2-52-16-11-44.eu-west-1.compute.amazonaws.com:http (CLOSE_WAIT)
Plex\x20T 1670 plex 75u IPv4 32467 0t0 TCP r2d2.lovelady.com:50452->ec2-18-203-176-12.eu-west-1.compute.amazonaws.com:http (CLOSE_WAIT)
httpd 1358151 root 3u IPv4 157704069 0t0 TCP *:http (LISTEN)
httpd 1358153 root 3u IPv4 157704069 0t0 TCP *:http (LISTEN)
httpd 1358154 root 3u IPv4 157704069 0t0 TCP *:http (LISTEN)
httpd 1358155 root 3u IPv4 157704069 0t0 TCP *:http (LISTEN)
httpd 2958297 root 3u IPv4 157704069 0t0 TCP *:http (LISTEN)
Again thanks to @djdomi I ran the following command; looks like Plex may be the culprit I'm looking for, but still no real answer to the original question:
root@r2d2:/etc/init.d# ps auxwww |egrep '834|1670'
plex 834 0.2 0.3 118780 75268 ? Ssl Jan31 131:48 /usr/lib/plexmediaserver/Plex Media Server
plex 1670 0.0 0.0 42192 12528 ? Sl Jan31 51:51 /usr/lib/plexmediaserver/Plex Tuner Service /usr/lib/plexmediaserver/Resources/Tuner/Private /usr/lib/plexmediaserver/Resources/Tuner/Shared 1.24.2.4973-2b1b51db9 32600
The paths shown just contain a bunch of .ini files.
