Slashdot Mirror

and this doesn't give me confidence in the SM team

Then you should probably stay away from Debian, Sendmail, Apache, or...well, hell, just stay away from Open Source, period, if a server/distro compromise is the measuring stick you use to measure "confidence."

You need a smart gateway. Your E1's border router, or a gateway immediately behind it, needs traffic shaping and queueing. Pretty much any circuit anywhere needs traffic queueing. Either side of your E1 could probably benefit from a compressed virtual circuit such as maybe a VPN. Compress all traffic that way. If you locally host your web servers, you can use a reverse proxy that includes mod_gzip and other stuff to strip whitespace from their content. You can also control your users' behaviors with caching proxies like squid and with a layer 7 packet filter. The layer 7 filter will protect against p2p and such. If you think the network is being abused but you want to encourage self-censorship, make the squid logs public. :)

Apache Week

To quote ApacheWeek: One of the new features included in [Apache 2.0.51] is that a container can now be used to limit the effect of a Satisfy directive to specific methods. Unfortunately, a bug in the implementation meant that merging of Satisfy directives did not work correctly. The result was that if "Satisfy Any" was used, for example, in directory /foo/bar/, it could also take effect in the higher context, /foo/. If directory /foo/ also had access control configured, this could then be bypassed.

An input validation issue in IPv6 literal address parsing which can result in a negative length parameter being passed to memcpy.
[CAN-2004-0786]

A buffer overflow in configuration file parsing could allow a local user to gain the privileges of a httpd child if the server can be forced to parse a carefully crafted .htaccess file.
[CAN-2004-0747]

A segfault in mod_ssl which can be triggered by a malicious remote server, if proxying to SSL servers has been configured.
[CAN-2004-0751]

A potential infinite loop in mod_ssl which could be triggered given particular timing of a connection abort.
[CAN-2004-0748]

A segfault in mod_dav_fs which can be remotely triggered by an indirect lock refresh request.
[CAN-2004-0809]

I was referring to the general practice of patching to avoid vulnerabilities.

Ok, here is the list for 2.0.

It doesn't look like any of those will root your server... just a couple of DOS attacks if your server is misconfigured.

Just Don't Store Your Important Source Code On It.... :))))))))))))

From what I understand, It's all about the performance. Apache 1.3.x supposedly has better performance with PHP when compared to the corresponding Apache 2.0.x release.

Could you provide any info about the Apache exploit? I checked here but I don't see anything recent that looks like a big deal.

Apache for Linux isn't the same as Apache for BSD isn't the same as Apache for Solaris isn't the same as Apache for Windows isn't the same as...

The following Apache Week article documents the "monoculture" of Apache, complete with a listing of security vulnerabilities affecting different Linux distributions differently.
Vendor patches to Apache

I think it's safe to say that Linux/Apache isn't vulnerable in the same way as a million IIS servers.

Wow the website has been slashdotted already. Come on, Alex, just because ApachePDA can run on your new Treo 600, you shouldn't have thrown away your server just yet...

...100% of web servers run Apache on Linux, thanks to VeriSign's DNS wildcard being hosted on Apache/Linux.

I used to read http://www.apacheweek.com/ fairly regularly. Now seems to be not maintained as well.

1) Apache 2.1 has more bugs than some unknown commercial competitor. If the version is correct, a development (not-ready-for-release) build was pitted against a released commercial build. Not fair playing ground.

2) Reasoning does not detail the severity or kind of the bugs. Certainly, a web server not being able to handle a type of format (pdf, csv, ogg vorbis) is less severe than a security hole. Pitted against IIS, I would trust Apache even if it had more bugs, because historically it has had fewer security patches. Check out Apache's 2.0 known patches vs IIS 5.0

From Netcraft: "The site www.sco.com is running Apache/1.3.14 (Unix) mod_ssl/2.7.1 OpenSSL/0.9.6 PHP/4.0.3pl1 on Linux."

Wow they're even running a vulnerable version of Apache... ON LINUX...

1.3.14 has had SERIOUS issues fixed since its release...

http://www.apacheweek.com/features/security-13

Being open source is no silver bullet; for example see this thread about Exhausting all your memory - the latest reported bug in Apache.

This is a remote denial of service attack which could be carried out fairly easily upon a LAN, or with a decent connection/zombie network over the net.

All seven of them? All long fixed? Page not updated since January 23, 2003? I'd LOVE to send them that. Comparing that to the long and varied string of IIS compromises/failures/destruction would be enough to get even the pointiest headed boss to make the switch. Good idea. Thanks!

Would you also send them the list of Apache security alerts? Or is that too much truth for you?

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]

ApacheWeek also has a review of this book found here, link

Also see Apache Week Pro Apache 2 review

Security? A comparison of 2001 CERT advisories shows that closed source software constituted 72%.

alldas.org defacement statistics per OS place Linux, an open source OS, at 22%, while Solaris, which is closed source, clocks in at 4%.

I also note that you failed to answer my question: if open source makes for secure software, then why do we need something like OpenBSD at all? Why are not all open source OS's as secure as OpenBSD?

The bottom line is that the distinction closed/open should make very little difference when evaluating the security aspect of any particular installation.

Stability? Netcraft shows that the web servers with the top 10 average [netcraft.com] and the top 19 maximum [netcraft.com] uptimes are Open Source.

They get great stability and security through honest desire and mass co-operation.

Linux, FreeBSD and OpenBSD has NEVER crashed on me in normal circumstances

Learning OpenBSD for someone who is knowledgable about network security is far from steep learning.

Even in light of the recent vulnerability, Apache actually has a good security history. The last time it was mentioned in a CERT advisory was 1996. IIS has been mentioned 8 times since.

Can you find a closed source hole that was fixed in hours?

Incidentally, most of the (relatively few)problems that Apache has had since version 1.3 are on the Windows version of Apache.

Future articles promise to delve into greater detail about other aspects of Apache.

The article
in question says nothing of the sort. It notes that the development processes of apache have changed over the years, with associated wins and losses.

Why has IIS taken over the SSL market? Because it ships with EAPI.

Thanks for the laugh.

It's not clear when the Open Source Edition (or whatever) will come out and I didn't find anything at the official Apache Site.

Apache Week has more information on this:

Those waiting since April for a new 2.0 beta will have to keep on waiting after another release candidate, 2.0.27, was abandoned this week when a bug was discovered while running the code on the live apache.org server. Some httpd processes were found to be stuck in infinite loops while reading POST requests; the bug was traced to the code handling request bodies. After fixes for this bug and a build problem on BSD/OS were checked in, the tree was tagged ready for a 2.0.28 release.

Apache Week explains the changes and highlights the 3 security vulnerabilities fixed by this release

For example, a site dedicated to a specific topic, such as Apache, or book reviews? Is there enough of a market, or interest, in any one of these categories? How many new stories are there every day about, e.g., Apache, that would interest readers without becoming ApacheWeek, an Apache mirror, or a site dedicated to programming Apache? (not that those are not all great ideas!) I'm definitely OK with being that technical, but the question is, would there be enough reader interest for it to be worthwhile? (i ran with the Apache topic here, but it could apply to a lot of other topics.)

darren

Here's the link to info about Apache 2.0 which I actually wanted to include in my post above:

http://www.apacheweek.com/features/apac he20

Chris

Also Dan Kegel wrote an interesting web page in response to the whole Mindcraft NT/IIS vs. Apache/Linux fiasco and on that page are several detailed measures to improve Apache's performance under Linux:

Dan Kegel's Mindcraft Redux page
Apache Week 'zine

...as for my own personal experience w/ Apache I learned that when compile Apache, remove any Apache modules you won't be needing saves plenty of RAM, and in the httpd.conf file you want to set StartServers, MaxClients, and MaxRequestsPerChild so that Apache does not spawn new children too often -- the trick is before you start Apache look at "top" count the number of processes, now start Apache under normal traffic conditions, look at number of processes you're running now to see how many http children are running -- whatever that number is add 10, and that should be your StartServers setting. The MaxRequestsPerChild default is 30 but I like to crank it up to 300 or more so that http children are not being killed and recreated too often (the reason for that setting was to avoid possible memory leaks from sucking up all your RAM which hasn't been a problem with the httpd's I've worked with)

Hmm...
I'm reading the PCMag test and I see that they are using a kernel 2.0.35 and a Stronghold Webserver...

How good was the 2.0.* series at Multiprocessing?
and, Isn't Stronghold slower than Apache due to the security issues?

And why do they only test (as it seems to me) static webpages... aren't dynamic ones a better way of showing what the server/OS is good for?
(I think I saw a note on apacheweek ( http://www.apacheweek.com) that Apache in fact did perform better than other servers w. dynamic pages than static ones... (I might be wrong here))

I also see much people saying that Apache is slow (I know it wasn't made for performance) Therefore I'd like to see a test comparing Apache under different OSes... Linux, *BSD, Solaris, NT (when the NT version is stable) and so on...

/Droid