Re: [RFC] http_log functions to log buffers

2013-08-06 Thread Jeff Trawick
On Tue, Aug 6, 2013 at 1:39 AM, Michael Felt mamf...@gmail.com wrote: I have not studied logging in httpd. The only logs I have ever looked at are the error_logs and access_logs. These look like something different. For systems security I like to use syslog as a place to collect data. If apr

Re: [PATCH] systemd socket activation

2013-08-06 Thread Paul Querna
Committed to trunk in r1511033. On Wed, Jul 24, 2013 at 12:00 AM, Jan Kaluža jkal...@redhat.com wrote: On 07/21/2013 11:14 PM, Paul Querna wrote: Hiya Y'all, long time no patches :-) Attached is a patch that would let httpd use systemd's socket activation feature:

breach attack

2013-08-06 Thread Paul Querna
Hiya, Has anyone given much thought to changes in httpd to help mitigate the recently publicized breach attack: http://breachattack.com/ From an httpd perspective, looking at the mitigations http://breachattack.com/#mitigations 1) Disabling HTTP compression 2) Separating secrets from user

Re: breach attack

2013-08-06 Thread Eric Covener
On Tue, Aug 6, 2013 at 1:24 PM, Paul Querna p...@querna.org wrote: Hiya, Has anyone given much thought to changes in httpd to help mitigate the recently publicized breach attack: http://breachattack.com/ From an httpd perspective, looking at the mitigations

Re: breach attack

2013-08-06 Thread Paul Querna
On Tue, Aug 6, 2013 at 10:32 AM, Eric Covener cove...@gmail.com wrote: On Tue, Aug 6, 2013 at 1:24 PM, Paul Querna p...@querna.org wrote: Hiya, Has anyone given much thought to changes in httpd to help mitigate the recently publicized breach attack: http://breachattack.com/ From an httpd

Re: breach attack

2013-08-06 Thread Steffen
Good instructive and advisable config: https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy On Tuesday 06/08/2013 at 19:24, Paul Querna wrote: Hiya, Has anyone given much thought to changes in httpd to help mitigate the

Re: breach attack

2013-08-06 Thread Paul Querna
On Tue, Aug 6, 2013 at 10:38 AM, Steffen i...@apachelounge.com wrote: Good instructive and advisable config: https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy Well, Forward-Secrecy is really about the NSA capturing your

Re: mod_autoindex string pluggability

2013-08-06 Thread Ben Reser
On Mon, Aug 5, 2013 at 5:51 AM, Tim Bannister is...@jellybaby.net wrote: How about implementing XHTML → JSON as a filter? Either with existing modules or with something dedicated to autoindex. That sounds really ugly if you ask me. For one thing he's trying to avoid parsing XHMTL so now

Re: breach attack

2013-08-06 Thread Rainer Jung
On 06.08.2013 19:36, Paul Querna wrote: On Tue, Aug 6, 2013 at 10:32 AM, Eric Covener cove...@gmail.com wrote: On Tue, Aug 6, 2013 at 1:24 PM, Paul Querna p...@querna.org wrote: Hiya, Has anyone given much thought to changes in httpd to help mitigate the recently publicized breach attack:

New Application Including Apache

2013-08-06 Thread Riley Lloyd
Dear Apache Corporation, I am an an Apple Mobile Developer who would like to make a new web designing solution for today's web enthusiasts. My idea is to create an app that works as an offline server for the iPad device. Sort of like the MAMP program for Mac. To have the local server, I was

Re: New Application Including Apache

2013-08-06 Thread Jeff Trawick
On Tue, Aug 6, 2013 at 3:28 PM, Riley Lloyd riley.lloy...@me.com wrote: Dear Apache Corporation, I am an an Apple Mobile Developer who would like to make a new web designing solution for today's web enthusiasts. My idea is to create an app that works as an offline server for the iPad

Re: mod_autoindex string pluggability

2013-08-06 Thread Daniel Lescohier
output_directories seems html-specific code. Why not implement a brand-new output_directories_json, and have index_directories() function choose which function to call based on query args? Anyway, index_directories() has to change to send the correct content-type header, and to skip emit_head and

Re: mod_autoindex string pluggability

2013-08-06 Thread Sven Dowideit
On 05/08/13 22:51, Tim Bannister wrote: How about implementing XHTML → JSON as a filter? Either with existing modules or with something dedicated to autoindex. Heya Tim, thankyou - I'll file that away for future thought - I don't know anything about apache filters, so it might come in handy

Re: mod_autoindex string pluggability

2013-08-06 Thread Sven Dowideit
On 07/08/13 06:55, Daniel Lescohier wrote: output_directories seems html-specific code. Why not implement a brand-new output_directories_json, and have index_directories() function choose which function to call based on query args? Anyway, index_directories() has to change to send the correct