Posts Tagged apache

Secure apache against CVE-2011-3389 aka Beast attack

During the summer rumours about a new attack against SSL started circulating (CVE-2011-3389).
As it turns out, the attack itself was conceived years ago, deemed impractical, but it was nevertheless fixed in TLS 1.1. The new attack technique introduced a few optimizations to make it practical.

In terms of mitigation, I expect this problem will be largely addressed on the client side, despite a potential compatibility problem that may cause some TLS sites to stop working.

With this config you can avoid that attack.

SSLProtocol all -SSLv2
SSLHonorCipherOrder On
SSLCipherSuite ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM:!SSLV2:!eNULL

#NO Longer needed cause since IE 7 this works ;) 
#SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown

With OpenSSL 1.0.1 it must be

SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH

Tags: , , , ,

vserver ubuntu IPv6 network

Since some days there is IPv6 available for my server. But I noticed it just today. Editing /etc/network/interfaces and adding a new virtual interface didn’t work at all. The /etc/init.d/networking restart just showed errors. And ifconfig venet0 wasn’t satisfying.

What works is /etc/network/interfaces just adding the loopbback

iface lo inet6 loopback
        adress ::1
        netmask 128
        gateway fe80::1

Now the trick is to add /etc/rc.local and add this before exit 0

ip addr add 2a01:238:40ab:cd12:dead:beef:dead:beef/128 dev venet0
ip route add default via fe80::1 dev venet0

Than execute /etc/rc.local
Wonder o wonder. Ifconfig works and also ping6 ipv6.example.com

Than I had to add the new ipv6 adress to my apache config

Listen [2a01:238:40ab:cd12:dead:beef:dead:beef]:80

Don’t forget a to create a symlink from rc.local to /etc/rc2.d/S21rc2.local

Tags: , , , , , , ,

YSlow Etag misconfigured

YSlow hat gemeckert, dass der Etag misconfigured / falsch gesetzt sei.

Um das zu ändern muss man

FileEtag All

ändern zu

FileETag MTime Size

 

Wenn dann noch bei einzelnen Dateien fehler auftreten, wie z.B. dem favicon.ico fehlt der korrekte mime type.

Addtype font/truetype .ttf
AddType image/x-icon .ico

 

etags

Tags: , , , ,

Apache AJP reverse proxy

With apache it is possible to have a reverse proxy with AJP instead of http. With the use of mod_proxy_ajp it is very simple to set up and faster than just plain http protocol

<VirtualHost *:80>
    ServerName jenkins
    DocumentRoot "/mario/Apache22/htdocs"
    <Directory "/mario/Apache22/htdocs">
        Options Indexes Includes FollowSymLinks
        AllowOverride All
        Order Allow,Deny
        Allow from all
        Deny from none
    </Directory>
    <Location />
        ProxyPass ajp://localhost:8009/
        ProxyPassReverse ajp://localhost:8009/
    </Location>

    SetEnv vhostname jenkins
    Header add X-Server-Name %{vhostname}e
</virtualhost>

Than start the backend server, in this case only with AJP and listen only on localhost

java -jar jenkins.war --httpPort=-1 --ajp13ListenAddress=127.0.0.1

Tags: , , , , , ,

Zend framework lucene UTF-8 problem

I had issues with the zend framework and its implementation of lucene. It saved the values from my UTF-8 database in the lucene files with characters like UTF-8 in ISO 8859-1 like on the search result page. And I wasn’t able to search case insensitive.

I noticed that the apache header (zend server CE) wasn’t sending UTF-8. So I added AddDefaultCharset utf-8 to my httpd.conf. Didn’t help.

What helped: In the Bootstrap.php adding to the init of the search

Zend_Search_Lucene_Analysis_Analyzer::setDefault(new Zend_Search_Lucene_Analysis_Analyzer_Common_Utf8());
Zend_Search_Lucene_Search_QueryParser::setDefaultEncoding('utf-8');
Zend_Search_Lucene_Analysis_Analyzer::setDefault(new Zend_Search_Lucene_Analysis_Analyzer_Common_Utf8_CaseInsensitive());

In the model it is needed to decode it to ISO 8859-1 and than save it as UTF-8. Sounds insane, but it was the only thing that works for me.

$doc->addField(Zend_Search_Lucene_Field::Text('lucene_DB_CLOUMN_NAME',utf8_decode($db_apater_result['DB_CLOUMN_NAME']),'UTF-8'));

WTF Zend Lucene!

Tags: , , , , , , , , ,

configure apache 2.3 build

./configure –prefix=/opt/apache2 –enable-pie –enable-mods-shared=all –enable-authn-dbd –enable-so –disable-include –enable-deflate –enable-headers –enable-expires –enable-ssl=shared –enable-mpms-shared=all –with-mpm=worker –enable-rewrite –with-z=/home/mario/apache24/httpd-2.3.11-beta/srclib/zlib –enable-module=ssl –enable-fcgid

for fcgid

APXS=/opt/apache2/bin/apxs ./configure.apxs

Tags: , , , ,

mod lua error handling sux

I still dislike the 500 error handling in lua. Well scripting got easier with practicing :P But the error handling realy sux a lot compared to PHP where I come from. I made a bit “benchmarking”. OK I took very different scripts, but PHP seems faster to me than lua. Plus for lua is that you are able to write direcly into apache log files.

Tags: , , ,

compile lua on windows

Grab the “newest” (2008) http://www.lua.org/ftp/lua-5.1.4.tar.gz
unpack it. Compiling with VC++ is very easy.

Open the x64 %comspec% /E:ON /V:ON /T:0E /K “C:\Program Files\Microsoft SDKs\Windows\v7.0\Bin\SetEnv.cmd” /Release
or x86 command line
%comspec% /k “”C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\vcvarsall.bat”” x86

browse to lua folder and run

etc\luavs
copy /y src\*.* .\

Done!

Tags: , , , , ,

build mod_geoip

Obtain GeoIP-1.4.6 from maxmind.com and built per included instructions.
Build Module against an IPv6 Enabled Apache Build

Obtain GeoIP-1.4.6 from maxmind.com and built per included instructions.
Build Module against an IPv6 Enabled Apache Build

del *.obj *.exp *.lib *.so
set APACHE=C:\Apache22
set GEOIPROOT=C:\Build\GeoIP-1.4.6
cl  /nologo /MD /O2 /LD /W3 -DWIN32 -D_WIN32 -I%GEOIPROOT%\libGeoIP -I%APACHE%\include /c /Fomod_geoip.obj mod_geoip.c
link /NODEFAULTLIB:LIBCMT kernel32.lib "%APACHE%\lib\libhttpd.lib" "%APACHE%\lib\libapr-1.lib" "%APACHE%\lib\libaprutil-1.lib" "%GEOIPROOT%\libGeoIP\GeoIP.lib" /nologo /subsystem:windows /dll /machine:I386 /out:mod_geoip.so mod_geoip.obj

Tags: , , ,

Giving mod_logrotate a signature

This is my first trial giving a third party module a signature.

--- mod_log_rotate.c.orig    2008-07-24 13:17:45.000000000 +0200
+++ mod_log_rotate.c    2010-11-21 02:31:43.123503300 +0100
@@ -399,6 +399,19 @@
 return add;
 }
 
+/* map into the first apache */
+static int log_rotate_post_config( apr_pool_t * p, apr_pool_t * plog, apr_pool_t * ptemp, server_rec * s)
+{
+    ap_add_version_component(p, "mod_log_rotate/1.00");
+    return OK;
+}
+
+static void log_rotate_register_hooks(apr_pool_t *p)
+{
+    ap_hook_post_config( log_rotate_post_config,   NULL, NULL, APR_HOOK_MIDDLE );
+}
+
+
 module AP_MODULE_DECLARE_DATA log_rotate_module = {
 STANDARD20_MODULE_STUFF,
 NULL,                       /* create per-dir config */
@@ -406,6 +419,6 @@
 make_log_options,           /* server config */
 merge_log_options,          /* merge server config */
 rotate_log_cmds,            /* command apr_table_t */
-    NULL                        /* register hooks */
+    log_rotate_register_hooks   /* register hooks */
 };

Tags: , , ,

Archives by Subject:

Archives by Month: