Hi all,
The following YUM updates have just been released:
base-apache (5107R + 5108R):
==========================
There appears to be some weird problem with SSL certificates on BlueOnyx 5107R
and 5108R. The GUI management pages for these certainly have a few issues
which need to be addressed. At this time the import and setup of SSL
certificates appears to have a "hit and miss" success rate. This is still
being worked on.
In the meantime this update fixes another problem related with SSL
certificates: If SSL is enabled for a Vsite, then it may happen that web
access to that site may redirect endlessly. To fix that one a certain
RewriteRule has been removed from the Apache Vhost container. This update
will make sure that the offending RewriteRule is commented out in existing
Vsites and that new Vsites will directly have it commented out.
base-vsite (5106R, 5107R + 5108R):
=============================
This update to base-vsite improves the PHP security model of BlueOnyx one step
further.
Right now we support two different PHP implementations:
- The traditional mod_php implementation of PHP.
- The more secure suPHP approach using CGI/FastCG.
Both have their benefits and drawbacks, but suPHP generally offers the best
protection.
As recently discussed on the BlueOnyx mailing list it can sometimes be
difficult to find out which PHP scripts have sent emails. If there is an old
and vulnerable PHP script that has been tricked into sending SPAM, then the
usual tools and methods we have at hand for finding the culprit leave a lot to
be desired.
If suPHP is enabled on all Vsites, the headers of the sent emails will at
least tell us the username of the offending user. But if mod_php is used
instead, then all you have left is going through your logfiles at a
painstakenly pace.
This updated base-vsite module will change this:
If a PHP script now uses the PHP mail() function, it will not talk directly to
sendmail for the delivery, but will use a small round about through the new
executeable /usr/sausalito/sbin/phpsendmail instead.
This binary will log all PHP related email traffic to /var/log/maillog in an
easy to understand fashion, which will make it very easy to see which script
sent which email.
Additionally emails generated and sent by PHP scripts will have a "X-PHP-
Originating-Script" header, which tells us the numeric user ID of the owner of
the sending script and the name of the sending script:
X-PHP-Originating-Script: 502:mail.php
This information can then be used to look up the offending script in
/var/log/maillog.
The '502' in the above examle tells us that the numeric user ID of the owner
of the script was '502'. After the colon we see the name (just the name - not
the path!) of the offending script. In this case here 'mail.php'.
Now if we have such an email in front of us and would need to find out which
site and user the email really came from on our server, we would need to take
a look at /var/log/maillog like this:
cat /var/log/maillog|grep uid=502|grep mail.php
So we grep for the numeric user ID (502 in this case) and the name of the
script (mail.php) that was listed in the "X-PHP-Originating-Script:" header of
said email.
Or if we wanted to see just the log entries of all PHP related email activity,
we could use this command:
cat /var/log/maillog|grep sendmail-wrapper-php
That will show us all PHP related email activity.
Example:
Apr 19 01:10:18 5108r root: sendmail-wrapper-php: site=5108r1.smd.net,
client=10.1.128.1,
script=/home/.sites/28/site1/web/mailtest/mailtest/mail.php, uid=502,
user=xxx_admin
Apr 19 01:35:01 5108r root: sendmail-wrapper-php: site=5108r1.smd.net,
client=10.1.128.1,
script=/home/.sites/28/site1/web/mailtest/mailtest/mail.php, uid=502,
user=xxx_admin
For more technical information about this update, please see [BlueOnyx:10186]
on the BlueOnyx mailing list.
--
With best regards
Michael Stauber
_______________________________________________
Blueonyx mailing list
Blueonyx@mail.blueonyx.it
http://mail.blueonyx.it/mailman/listinfo/blueonyx
