RE: [EMAIL PROTECTED] Apache 2.2.8 compile files on x86_64 SLES 10

2008-01-23 Thread Foster, Stephen (ASPIRE)
Hi there, We have engineered 2.2.4 for SLES10 and had a few issues surrounding pre-requisite OS packages and also had to make a few hacks. the pre-req packages we isolated were: zlib-devel-32bit-1.2.3-15.2 zlib-devel-1.2.3-15.2 openldap2-devel-32bit-2.3.19-18.6 openldap2-devel-2.3.19-18.6

[EMAIL PROTECTED] Reverse proxy security risks

2008-01-23 Thread Paul Cocker
We have a helpdesk system which is accessed via HTTPS. However, the web interface is handled via Apache Tomcat, which is shipped as part of the product and therefore cannot be updated independently by us as this could interfere with manufacturer patches and void our support. This makes us nervous o

Re: [EMAIL PROTECTED] Reverse proxy security risks

2008-01-23 Thread Christian Folini
Hi-ho, I propose you go with the reverse proxy and install ModSecurity with the Core Rule set. That should be enough for a general level of security. However, you should keep an eye on the audit-logs of ModSecurity, as the core rules let many possible attacks pass, but say so in the audit log. (T

[EMAIL PROTECTED] Apache mod_negotiation Input Validation Hole Permits Cross-Site Scripting Attacks

2008-01-23 Thread Lindsay Hausner
FYI http://www.securitytracker.com/alerts/2008/Jan/1019256.html lh.. - The official User-To-User support forum of the Apache HTTP Server Project. See http://httpd.apache.org/userslist.html> for more info. To unsubscribe, e-ma

Re: [EMAIL PROTECTED] Apache mod_negotiation Input Validation Hole Permits Cross-Site Scripting Attacks

2008-01-23 Thread Joshua Slive
On Jan 23, 2008 12:39 PM, Lindsay Hausner <[EMAIL PROTECTED]> wrote: > > FYI > > http://www.securitytracker.com/alerts/2008/Jan/1019256.html What's your point? The Apache httpd developers don't consider this a vulnerability because it can only be exploited if you can write arbitrary filenames to

[EMAIL PROTECTED] New Portal Using Apache & Tomcat

2008-01-23 Thread Tony Anecito
I just wanted to say thanks to the Apache & Tomcat teams for providing the means for a new Type of Portal!!! Over the holiday a new portal was released for eLearning that uses searches/mapping/video/video capture and a lot more. It uses the latest Apache and Tomcat servers on the back in to host w

[EMAIL PROTECTED] Make failing for 2.2.8 on AIX 5.3

2008-01-23 Thread O'DELL, TODD E (ATTOPS)
I'm attempting to build the httpd 2.2.8 on an AIX 5.3 system. I'm using the IBM compiler cc_r. When I run this configuration it configures ok, though it doesn't find the Expat 1.95.8 I have at /apps/support/packages while it does find the OpenSSL at the same location. CC="/usr/vac/bin/cc_r"; OBJEC

[EMAIL PROTECTED] PerlSetEnv in .htaccess ?

2008-01-23 Thread abhishek jain
Hi Friends, I am using a shared hosting a/c and it allows me to use .htaccess now i am writing the following lines in .htaccess and then the server is giving the 500 internal server error PerlSetEnv EMBPERL_OBJECT_BASE _base.epl Is there a method to write the code in another way so that the serv

[EMAIL PROTECTED] Re: PerlSetEnv in .htaccess ?

2008-01-23 Thread abhishek jain
Pl. do not mind i am posting again within an hour, but the problem is taking my nerves, is there a way to go forward i believe the webhost is not allowing to set me PerlSetEnv is there another method to do the same, Expecting replies, abhi On 1/24/08, abhishek jain <[EMAIL PROTECTED]> wrote: > >

[EMAIL PROTECTED] message logged to error log

2008-01-23 Thread Sam Sherlock
Hi All, when I start apache on my windows 2000 pro machine I have the following logged as an error - apache 2.2.4. I have searched and found other with the same error message and [Thu Jan 24 02:34:59 2008] [notice] Apache/2.2.4 (Win32) PHP/5.2.5 configured -- resuming normal operations [Thu Jan

Re: [EMAIL PROTECTED] Re: PerlSetEnv in .htaccess ?

2008-01-23 Thread Scott Gifford
"abhishek jain" <[EMAIL PROTECTED]> writes: > Pl. do not mind i am posting again within an hour, but the problem is taking > my > nerves, is there a way to go forward i believe the webhost is not allowing to > set me PerlSetEnv is there another method to do the same, You could try just using Set

Re: [EMAIL PROTECTED] Re: PerlSetEnv in .htaccess ?

2008-01-23 Thread abhishek jain
On 1/24/08, Scott Gifford <[EMAIL PROTECTED]> wrote: > > You could try just using SetEnv. Yes i tried but this was also not working, a 500 internal server error appears, You could also edit your scripts to begin with: > >$ENV{EMBPERL_OBJECT_BASE}='_base.epl' Actually i want this variable b

Re: [EMAIL PROTECTED] Re: PerlSetEnv in .htaccess ?

2008-01-23 Thread abhishek jain
On second thoughts is there a method by which i can execute some piece of code to execute even before my scripts are called, remember i am on a shared host, abhi On 1/24/08, abhishek jain <[EMAIL PROTECTED]> wrote: > > > > On 1/24/08, Scott Gifford <[EMAIL PROTECTED]> wrote: > > > > You could try

Re: [EMAIL PROTECTED] PerlSetEnv in .htaccess ?

2008-01-23 Thread Octavian Rasnita
From: abhishek jain > Hi Friends, > I am using a shared hosting a/c and it allows me to use .htaccess > now i am writing the following lines in .htaccess and then the server is giving the 500 internal server error > PerlSetEnv EMBPERL_OBJECT_BASE _base.epl Check the error log in ord

Re: [EMAIL PROTECTED] PerlSetEnv in .htaccess ?

2008-01-23 Thread abhishek jain
On 1/24/08, Octavian Rasnita <[EMAIL PROTECTED]> wrote: > > *From:* abhishek jain <[EMAIL PROTECTED]> > > > > > Hi Friends, > > I am using a shared hosting a/c and it allows me to use .htaccess > > now i am writing the following lines in .htaccess and then the server is > giving the 500 internal s

RE: [EMAIL PROTECTED] message logged to error log

2008-01-23 Thread Axel-Stephane SMORGRAV
This does not seem to me as anything to be worried about, but rather as perfectly normal operations of your apache. The entries are logged at level NOTICE. If you want to avoid having such messages in your logs, change the log level. Refer to http://httpd.apache.org/docs/2.0/mod/core.html#logl

Re: [EMAIL PROTECTED] message logged to error log

2008-01-23 Thread Sam Sherlock
thanks for that info :) On 24/01/2008, Axel-Stephane SMORGRAV <[EMAIL PROTECTED]> wrote: > > This does not seem to me as anything to be worried about, but rather as > perfectly normal operations of your apache. The entries are logged at level > NOTICE. > > If you want to avoid having such messag

Re: [EMAIL PROTECTED] Re: PerlSetEnv in .htaccess ?

2008-01-23 Thread Scott Gifford
"abhishek jain" <[EMAIL PROTECTED]> writes: > On second thoughts is there a method by which i can execute some > piece of code to execute even before my scripts are called, remember > i am on a shared host, I don't know of a way to do exactly this on a shared host. If your provider supports mod_