Re: why does Header set send lower case header names?

2013-06-01 Thread Reindl Harald
Am 01.06.2013 20:37, schrieb Guenter Knauf: On 01.06.2013 16:39, Reindl Harald wrote: IfModule mod_headers.c Header set X-DNS-Prefetch-Control off /IfModule from the network: x-dns-prefetch-control: off works for me - just tested on Win32 and NetWare with httpd-trunk: curl -I http

Re: unsubscribe

2013-05-31 Thread Reindl Harald
and even if there is a list-footer at the end of each message as on many mailing-list you get the same unsubscribe me posts it does not matter what you do as list-admin, people only manage to subscribe, but ignore welcome messages and any sort of unsubscribe links and the really smart ones

Re: unsubscribe

2013-05-30 Thread Reindl Harald
do it yourself like on any other mailing-list mail-headers are your friend list-unsubscribe: mailto:dev-unsubscr...@httpd.apache.org Am 30.05.2013 18:47, schrieb RONALD FARRIER: Please unsubscribe On May 30, 2013, at 11:23 AM, Richard Genthner rgenth...@symplicity.com

Re: DOS-Protection: RequestReadTimeout-like option missing

2013-05-23 Thread Reindl Harald
Am 23.05.2013 15:14, schrieb Dirk-Willem van Gulik: On 11 May 2013, at 20:26, Reindl Harald h.rei...@thelounge.net wrote: after the connection is established and in case of connect you have already passed the TCP transmissions and kernel settings like net.ipv4.tcp_fin_timeout = 5

Re: DOS-Protection: RequestReadTimeout-like option missing

2013-05-11 Thread Reindl Harald
(); $start = time(); $fp = fsockopen ($host, '80', $errno, $errstr, 180); while (!feof($fp)) { $buffer = fgets($fp, 128); } echo (time() - $start) . seconds\n; flush(); ? Am 11.05.2013 15:08, schrieb Reindl Harald: Hi http://httpd.apache.org/docs/2.4/mod/mod_reqtimeout.html i am missing

Re: DOS-Protection: RequestReadTimeout-like option missing

2013-05-11 Thread Reindl Harald
Am 11.05.2013 19:49, schrieb Eric Covener: localhost test with request: 10 seconds test without request: 41 seconds As the manual says: When an AcceptFilter is in use (usually the case on Linux and FreeBSD), the socket is not sent to the server process before at least one byte (or the

Re: DOS-Protection: RequestReadTimeout-like option missing

2013-05-11 Thread Reindl Harald
Am 11.05.2013 20:26, schrieb Eric Covener: CONFIG proxy.config.net.defer_accept INT 1 of Trafficserver is a damned good idea in such cases - in real life it takes never longer than 1 second and even if - it's configureable Seems to have started that way:

Re: DOS-Protection: RequestReadTimeout-like option missing

2013-05-11 Thread Reindl Harald
Am 11.05.2013 21:14, schrieb Stefan Fritsch: On Saturday 11 May 2013, Reindl Harald wrote: https://issues.apache.org/bugzilla/show_bug.cgi?id=41270 is most likely unrelated to the problem i see, but nobody and nothing needs 30 seconds to complete a TCP connection, most requests including

Re: DOS-Protection: RequestReadTimeout-like option missing

2013-05-11 Thread Reindl Harald
Am 11.05.2013 21:22, schrieb Reindl Harald: Am 11.05.2013 21:14, schrieb Stefan Fritsch: On Saturday 11 May 2013, Reindl Harald wrote: https://issues.apache.org/bugzilla/show_bug.cgi?id=41270 is most likely unrelated to the problem i see, but nobody and nothing needs 30 seconds to complete

mod_ratelimit design mistake

2013-05-10 Thread Reindl Harald
https://httpd.apache.org/docs/trunk/mod/mod_ratelimit.html Provides a filter named RATE_LIMIT to limit client bandwidth. The connection speed to be simulated is specified, in KiB/s compared with external mod_bw.so IMHO this is a design mistake * saying i have several virtual hosts * my line

Re: mod_ratelimit design mistake

2013-05-10 Thread Reindl Harald
Am 10.05.2013 22:38, schrieb Eric Covener: On Fri, May 10, 2013 at 4:11 PM, Reindl Harald h.rei...@thelounge.net wrote: https://httpd.apache.org/docs/trunk/mod/mod_ratelimit.html Provides a filter named RATE_LIMIT to limit client bandwidth. The connection speed to be simulated is specified

Re: New SecRemoteAddrDefine (httpd-dev CCed)

2013-05-06 Thread Reindl Harald
:19 AM, Reindl Harald h.rei...@thelounge.net mailto:h.rei...@thelounge.net wrote: why do you refuse to understand that we do not need a new feature or at it is NOT up to you to re-invent the wheel Apache 2.2 works with proxy and mod_rpaf does not need any change

Re: New SecRemoteAddrDefine (httpd-dev CCed)

2013-05-06 Thread Reindl Harald
at 10:02 AM, Reindl Harald h.rei...@thelounge.net mailto:h.rei...@thelounge.net wrote: thank you, this works exactly as expected with Apache 2.4 and mod_remoteip / mod_security, how i tested is expplained at bottom PLEASE revisit the mod_security 2.7.2 change * Fixed

Re: New SecRemoteAddrDefine (httpd-dev CCed)

2013-05-06 Thread Reindl Harald
as it helps because the overall behavior get's unpredictable however, please do not forget revisit Fixed mod_security displaying wrong ip address in error.log using apache 2.4 from modsec 2.7.2! On Mon, May 6, 2013 at 10:08 AM, Reindl Harald h.rei...@thelounge.net mailto:h.rei...@thelounge.net wrote

Re: New SecRemoteAddrDefine (httpd-dev CCed)

2013-05-06 Thread Reindl Harald
can do a lot of harm On Mon, May 6, 2013 at 10:17 AM, Reindl Harald h.rei...@thelounge.net mailto:h.rei...@thelounge.net wrote: Am 06.05.2013 15:11, schrieb Breno Silva: Yes.. but we cannot assume all users is doing it right :) And to be honest i think many are not doing

Fwd: [mod-security-users] Fwd: Availability of ModSecurity 2.7.3 mod_remoteip :-(

2013-05-05 Thread Reindl Harald
2013 00:48:40 +0200 Von: Reindl Harald h.rei...@thelounge.net An: Mod Security mod-security-us...@lists.sourceforge.net well, this would be a workaround but better than nothing the right solution would be to check how %a and %h in the httpd-sorce for logging are specified because as httpd-upstream

Re: URL scanning by bots

2013-05-03 Thread Reindl Harald
Am 03.05.2013 06:35, schrieb Ben Reser: On Thu, May 2, 2013 at 4:53 PM, Guenter Knauf fua...@apache.org wrote: isnt that one of the core issues - that folks who dont know what they do run a webserver? And then, shouldnt these get punished with being hacked so that they try to learn and finally

Re: URL scanning by bots

2013-05-03 Thread Reindl Harald
Am 03.05.2013 11:38, schrieb André Warnier: I agree that 404's are legitimate responses. And I agree that legitimate clients/users can expect to receive them. But if they do receive them when appropriate, but receive them slower than other kinds of responses, this is not really breaking

Re: URL scanning by bots

2013-05-02 Thread Reindl Harald
Am 02.05.2013 10:22, schrieb André Warnier: These tools must be downloaded separately, installed, configured and maintained, all by someone who knows what he's doing. And this means that, in the end (and as the evidence shows), only a tiny minority of webservers on the Internet will

Re: URL scanning by bots

2013-05-01 Thread Reindl Harald
Am 01.05.2013 11:37, schrieb Ben Laurie: Well, no, actually this is not accurate. You are assuming that these bots are written using blocking io semantics; that if a bot is delayed by 2 seconds when getting a 404 from your server, it is not able to do anything else in those 2 seconds. This

Re: URL scanning by bots

2013-05-01 Thread Reindl Harald
Am 01.05.2013 13:14, schrieb Ben Laurie: The fact you cannot explain the evidence does not invalidate the evidence what evidence has this thread? the whole idea of slow down 404 repsones is broken and must never be default on any setup nor should it be implemented at all - period

Re: URL scanning by bots

2013-05-01 Thread Reindl Harald
Am 01.05.2013 13:51, schrieb André Warnier: There is so far one possible pitfall, which was identified by someone earlier on this list : the fact that delaying 404 responses might have a bad effect on some particular kind of usage by legitimate clients/users. So far, I believe that such

Re: URL scanning by bots

2013-05-01 Thread Reindl Harald
Am 01.05.2013 14:00, schrieb Reindl Harald: here you have something to read and learn that more and more attacks are done this way by exhausting ressources without high bandwith and THIS are the real problems server-admins have to fight and not the noise you see on your small site http

Re: URL scanning by bots

2013-05-01 Thread Reindl Harald
Am 01.05.2013 14:09, schrieb Marian Marinov: On 05/01/2013 03:00 PM, Reindl Harald wrote: and YES making DOS-attacks easier is treatet as security risk by any professional auditor and there where i work threat middle means fix it or shut down the customers project and the last time i got

Re: URL scanning by bots

2013-04-30 Thread Reindl Harald
Am 30.04.2013 12:03, schrieb André Warnier: As a general idea thus, anything which impacts the delay to obtain a 404 response, should impact these bots much more than it impacts legitimate users/clients. How much ? Let us imagine for a moment that this suggestion is implemented in the

Re: URL scanning by bots

2013-04-30 Thread Reindl Harald
Am 30.04.2013 20:38, schrieb Ben Laurie: On 30 April 2013 11:14, Reindl Harald h.rei...@thelounge.net wrote: no - this idea is very very bad and if you ever saw a DDOS-attack from 10 thousands of ip-addresses on a machine you maintain you would not consider anything which makes responses

Re: mod_macro… backport to 2.4

2013-03-09 Thread Reindl Harald
+1 because it does hurt nobody since it's not enabled by default but improve the sutuation for active users over the long have it maintained in the httpd-tree Am 09.03.2013 18:13, schrieb Mario Brandt: +1 Am Samstag, 9. März 2013 schrieb Jim Jagielski : I've proposed

Re: [VOTE] Release Apache httpd 2.4.4 as GA

2013-02-25 Thread Reindl Harald
Am 25.02.2013 08:54, schrieb Justin Erenkrantz: On Thu, Feb 21, 2013 at 5:27 AM, Justin Erenkrantz jus...@erenkrantz.com mailto:jus...@erenkrantz.com wrote: Anybody know if it still exists in Illumos? This sounds like a fun thing to tackle next week in Portland. =) (I'll be

Re: If/If-Match don't work for COPY

2013-02-25 Thread Reindl Harald
Am 25.02.2013 22:47, schrieb Timothy Wood: Sending a If or If-Match header with an invalid ETag doesn't result in a 412 Precondition Failed why in the world should it? you get back a 200 status code and content or a 305 Not Modified which you can EASY implement in any PHP-application too

Re: [VOTE] Release Apache httpd 2.4.4 as GA

2013-02-19 Thread Reindl Harald
%defattr(-,root,root) %{_includedir}/httpd %{_bindir}/apxs %dir %{_libdir}/httpd/build %{_libdir}/httpd/build/*.mk %{_libdir}/httpd/build/*.sh %{_sysconfdir}/rpm/macros.httpd %changelog * Tue Feb 19 2013 Reindl Harald h.rei...@thelounge.net - update to 2.4.4 RC - remove a lot of patches - remove

Re: no http-404 errors in ErrorLog

2013-02-08 Thread Reindl Harald
Am 08.02.2013 06:38, schrieb Reindl Harald: Am 07.02.2013 21:54, schrieb Stefan Fritsch: On Thursday 07 February 2013, Reindl Harald wrote: ErrorLog /var/log/apache_error.log LogLevel info https://issues.apache.org/bugzilla/show_bug.cgi?id=35768 what is here fixed in 2.4.1? httpd

Re: no http-404 errors in ErrorLog

2013-02-08 Thread Reindl Harald
the best log level config for your needs. Cheers Mario On 8 February 2013 13:17, Reindl Harald h.rei...@thelounge.net wrote: so because some guys was unhappy with this working behavior and did not want to use a higher LogLevel we now have to go the other direction and exlpode our

no http-404 errors in ErrorLog

2013-02-07 Thread Reindl Harald
ErrorLog /var/log/apache_error.log LogLevel info https://issues.apache.org/bugzilla/show_bug.cgi?id=35768 what is here fixed in 2.4.1? httpd-2.4.3 does not log 404 errors in ErrorLog imagine admins like me with some hundret vhosts and all of the systems and templates are developed inside the

Re: no http-404 errors in ErrorLog

2013-02-07 Thread Reindl Harald
Am 07.02.2013 13:39, schrieb Dennis Jacobfeuerborn: On 02/07/2013 12:26 PM, Reindl Harald wrote: ErrorLog /var/log/apache_error.log LogLevel info https://issues.apache.org/bugzilla/show_bug.cgi?id=35768 what is here fixed in 2.4.1? httpd-2.4.3 does not log 404 errors in ErrorLog

Re: no http-404 errors in ErrorLog

2013-02-07 Thread Reindl Harald
Am 07.02.2013 14:22, schrieb Dennis Jacobfeuerborn: with the old behavior it was easy to grep thrugh 404 errors of any vhost and find broken images in CSS files and so on Why can't you grep/awk through the access log files the same way you grep/awk through the error logs? Just because

Re: no http-404 errors in ErrorLog

2013-02-07 Thread Reindl Harald
Am 07.02.2013 21:54, schrieb Stefan Fritsch: On Thursday 07 February 2013, Reindl Harald wrote: ErrorLog /var/log/apache_error.log LogLevel info https://issues.apache.org/bugzilla/show_bug.cgi?id=35768 what is here fixed in 2.4.1? httpd-2.4.3 does not log 404 errors in ErrorLog imagine

Re: mod_remoteip does NOT change access-log IP

2013-01-24 Thread Reindl Harald
Am 24.01.2013 21:02, schrieb Stefan Fritsch: On Wednesday 23 January 2013, Reindl Harald wrote: hi LoadModuleremoteip_module modules/mod_remoteip.so RemoteIPHeaderX-Forwarded-For RemoteIPInternalProxy 127.0.0.1 10.0.0.4 10.0.0.103 91.118.73.4

Re: mod_remoteip does NOT change access-log IP

2013-01-24 Thread Reindl Harald
Am 24.01.2013 21:02, schrieb Stefan Fritsch: 10.0.0.103 - - [23/Jan/2013:17:01:53 +0100] GET /images/page/tidy_16.gif HTTP/1.1 304 - http://www.test.rh:8080/; Mozilla/5.0 (X11; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0 (-%) The problem seems to be ap_get_remote_host() which is

Re: mod_remoteip does NOT change access-log IP

2013-01-24 Thread Reindl Harald
Am 25.01.2013 00:34, schrieb Graham Leggett: On 24 Jan 2013, at 20:02, Stefan Fritsch s...@sfritsch.de wrote: The problem seems to be ap_get_remote_host() which is used by the %h used in the default access log format. But resolving an IP address that came via X-Forwarded-For does not

Re: mod_remoteip does NOT change access-log IP

2013-01-24 Thread Reindl Harald
Am 25.01.2013 03:47, schrieb Reindl Harald: Am 25.01.2013 00:34, schrieb Graham Leggett: On 24 Jan 2013, at 20:02, Stefan Fritsch s...@sfritsch.de wrote: The problem seems to be ap_get_remote_host() which is used by the %h used in the default access log format. But resolving an IP address

mod_remoteip does NOT change access-log IP

2013-01-23 Thread Reindl Harald
hi LoadModuleremoteip_module modules/mod_remoteip.so RemoteIPHeaderX-Forwarded-For RemoteIPInternalProxy 127.0.0.1 10.0.0.4 10.0.0.103 91.118.73.4 PHP - fine, exactly how it should do: _SERVER[SERVER_ADDR] 10.0.0.99 _SERVER[SERVER_PORT] 8080

Re: mod_remoteip does NOT change access-log IP

2013-01-23 Thread Reindl Harald
because a very mixed environement of vurtual hosts with or without trafficserver Am 23.01.2013 17:06, schrieb Reindl Harald: hi LoadModuleremoteip_module modules/mod_remoteip.so RemoteIPHeaderX-Forwarded-For RemoteIPInternalProxy 127.0.0.1 10.0.0.4 10.0.0.103 91.118.73.4

Re: mod_remoteip does NOT change access-log IP

2013-01-23 Thread Reindl Harald
mod_rpaf on httpd 2.2 replaces for sure ANY place like access-log, error-log and REMOTE_ADDR in scripts with the X-Forwarded-For from the trusted apache trafficserver SERVER_ADDR 10.0.0.99 SERVER_PORT 8080 REMOTE_ADDR 10.0.0.103 Am 23.01.2013 18:08, schrieb Reindl Harald: however

Re: Update on your 2.2 RM

2012-09-02 Thread Reindl Harald
Am 02.09.2012 20:44, schrieb Rainer Jung: Hi Bill, On 23.08.2012 23:44, William A. Rowe Jr. wrote: Sorry, I'm not ignoring the list (entirely). Seems Thunderbird and my ISP have decided not to dance anymore and it looks like I'm spending Thursday doing some fundamental email

Re: [Vote] httpd 2.2.23 release

2012-08-23 Thread Reindl Harald
Am 21.08.2012 21:25, schrieb William A. Rowe Jr.: Candidate binaries are available from http://httpd.apache.org/dev/dist/ - these do not yet constitute ASF releases. Win32 specific artifacts (x86 binary distribution and -win32-src.zip) will follow sometime later this evening. Feedback

Re: utf-8 - punycode for ServerName|Alias?

2012-08-01 Thread Reindl Harald
Am 01.08.2012 18:25, schrieb William A. Rowe Jr.: On 4/7/2012 2:00 AM, Reindl Harald wrote: Am 07.04.2012 08:33, schrieb William A. Rowe Jr.: So we have live registrars, no longer experimental, who are now registering domains in punycode. Make of it what you will. Do we want

Re: utf-8 - punycode for ServerName|Alias?

2012-07-30 Thread Reindl Harald
Am 30.07.2012 22:54, schrieb William A. Rowe Jr.: What is less clear is what precautions we should take when functioning as a forward proxy with proxy uri string contents, or presenting user-provided, non-canonicalized host names. I can imagine such translation being abused to conceal some

Re: md5crypt passwords

2012-06-20 Thread Reindl Harald
Am 20.06.2012 22:52, schrieb Stefan Fritsch: On Wed, 20 Jun 2012, Nick Edwards wrote: I posted this to users list last week but no-one bit, so I'm trying here. With md5crypt no longer recommended for use by its author, will Apache soon support sha256/sha512 in basic authentication via

Re: md5crypt passwords

2012-06-20 Thread Reindl Harald
Am 20.06.2012 23:19, schrieb Reindl Harald: Am 20.06.2012 22:52, schrieb Stefan Fritsch: On Wed, 20 Jun 2012, Nick Edwards wrote: I posted this to users list last week but no-one bit, so I'm trying here. With md5crypt no longer recommended for use by its author, will Apache soon

Re: md5crypt passwords

2012-06-20 Thread Reindl Harald
Am 20.06.2012 23:52, schrieb Stefan Fritsch: you do not need the original password! you only need a hash-collision and can leave out special chars completly to find one You need a password that gives the same value after 1000 rounds of md5(password md5(password md5(password ...))). This

Re: md5crypt passwords

2012-06-20 Thread Reindl Harald
Am 21.06.2012 00:14, schrieb Stefan Fritsch: On Wednesday 20 June 2012, Reindl Harald wrote: there is a reason why even the developer of md5crypt saw the need for a offical statement that md5crypt should never again be considered as secure in any case! http://phk.freebsd.dk/sagas

Re: CLOSE_WAIT problem

2012-05-25 Thread Reindl Harald
Am 25.05.2012 10:52, schrieb Bongjae Chang: Is the watcher thread which is going through all of the connections looking to see if they have been closed by the peer only solution? There is no thread. I see.. then I think that it will be useful if mod_proxy will support the feature

Re: Why aren't name-based vhosts not working properly under SSL?

2012-04-16 Thread Reindl Harald
Am 16.04.2012 17:34, schrieb Mikhail T.: If the SSL-certificate is the same for all named vhosts configured for the given IP-address/port-number combination, why can not the vhosts have different DocumentRoots and other settings? because SSL was misdesigned years ago and the Host-Header

Re: [VOTE] Release Apache httpd 2.4.2 as GA

2012-04-15 Thread Reindl Harald
Am 15.04.2012 18:54, schrieb Daniel Gruno: so to me it looks as if either SSI or type assingment is currently broken - at least on NetWare, not yet tested on other platforms ... I have tested your SSI tag with 2.4.2 on Debian 6 and Fedora 16 with the following options set: Options

Re: utf-8 - punycode for ServerName|Alias?

2012-04-07 Thread Reindl Harald
Am 07.04.2012 08:33, schrieb William A. Rowe Jr.: So we have live registrars, no longer experimental, who are now registering domains in punycode. Make of it what you will. Do we want to recognize non-ASCII strings in the ServerName|Alias directives as utf-8 - punycode encodings?

Re: please unsubscribe me from this group eom

2012-04-06 Thread Reindl Harald
Am 06.04.2012 07:05, schrieb Harish S Rathod: what about doing like instructed in the welcome-message as you subscribed or look in the header of every single mail of every mailing-list out there? list-unsubscribe: mailto:dev-unsubscr...@httpd.apache.org because you are too lazy to read and

Re: TRACE still enabled by default

2012-03-22 Thread Reindl Harald
Am 22.03.2012 16:17, schrieb Tom Evans: On Thu, Mar 22, 2012 at 3:15 PM, Eric Covener cove...@gmail.com wrote: How about providing a simpler way of turning it off, rather than turning it off by default? Arbitrarily, it seems, you can't use Limit or LimitExcept to restrict it, and instead

Re: TRACE still enabled by default

2012-03-21 Thread Reindl Harald
Am 17.03.2012 10:24, schrieb Roy T. Fielding: On Mar 16, 2012, at 7:18 AM, Eric Covener wrote: We still enable TRACE by default. Is this useful enough to justify making every other poor sap with a security scanner have to manually turn it off? Yes. I'm hoping 2.4.x is early enough

Re: TRACE still enabled by default

2012-03-21 Thread Reindl Harald
Am 21.03.2012 13:48, schrieb Tim Bannister: On 21 Mar 2012, at 12:39, Reindl Harald wrote: 1 out of a million servers needs TRACE enabled it was ALWAYS a good idea to disable ANYTHING by default what is not really needed and this principle will stay inetd normally ships with echo

Re: TRACE still enabled by default

2012-03-21 Thread Reindl Harald
Am 21.03.2012 14:41, schrieb Noel Butler: On Wed, 2012-03-21 at 13:55 +0100, Reindl Harald wrote: Firstly, as stated previously, I agree TRACE should be disabled by default because those that need it are probably at about 1 in 1, and I'd like to see a proper vote called

Re: TRACE still enabled by default

2012-03-21 Thread Reindl Harald
Am 21.03.2012 21:02, schrieb Greg Stein: On Wed, Mar 21, 2012 at 15:59, Mark Montague m...@catseye.org wrote: On March 21, 2012 15:33 , Roy T. Fielding field...@gbiv.com wrote: TRACE won't work at all if the most popular end-point doesn't support it. Why would this be a bad thing? Or, to

Re: httpd 2.4.1 vs mod_whatkilledus

2012-03-03 Thread Reindl Harald
Am 04.03.2012 02:35, schrieb Igor Galić: Hey folks, or rather: Jeff :) I'm finally getting around to updating my stack to httpd 2.4.1 (and PHP 5.4) and some things are breaking. mod_whatkilledus doesn't build with 2.4.1 you are aware that PHP 5.4.0 currently does not support Apache 2.4?

Re: Discuss: Dropping dsw/dsp files

2012-01-20 Thread Reindl Harald
Am 20.01.2012 21:50, schrieb Steffen: Building with GUI must be possible, always ! why? That is just the very strong point for building windows why? are there really still no options on windows to compile software automated without a GUI? signature.asc Description: OpenPGP digital

Re: Suggestion for improvment: Let apache does not fail after restart if a log dir is missing and let put an error or warning message in error log.

2011-12-21 Thread Reindl Harald
On 21.12.2011 09:04, Ali Nebi wrote: Hello, I would like to make a suggestion to apache web server developer and to open a discussion related with the way apache is working currently when a directory where apache must create logs files does not exists. and at least fix that apachectl

Re: Win 2.3.15 :: The timeout specified has expired

2011-11-21 Thread Reindl Harald
Am 21.11.2011 19:17, schrieb Stefan Fritsch: On Monday 21 November 2011, William A. Rowe Jr. wrote: On 11/21/2011 4:49 AM, Steffen wrote: Observing that the error.log is filling with [http:error] lines, never seen with 2.2: [http:error] [pid 3244:tid 2656] (70007)The timeout specified has

Re: [Vote] .htaccess logic abuse

2011-11-19 Thread Reindl Harald
Am 19.11.2011 17:44, schrieb Issac Goldstand: On 19/11/2011 00:38, William A. Rowe Jr. wrote: Resource abuse of an .htaccess config in the form of cpu/memory/bandwidth; [ ] Represents a security defect [X] Is not a security defect The sysadmin knows best. If it's a problem, disable

Re: Caching - Generating E-Tags

2011-10-09 Thread Reindl Harald
Am 10.10.2011 00:10, schrieb Igor Galić: - Original Message - request time because it normally contains the inode Which makes it quite useless in a farm with multiple servers as the same files will have different inodes. My recomendation is to use size and mtime well, most setups

Re: Caching - Generating E-Tags

2011-10-06 Thread Reindl Harald
Am 06.10.2011 19:03, schrieb Amila Liyanaarachchi: Hi Dev, I'm working on a caching protocol similar to HTTP on a different research. I have the following question regarding the e-tags. When does exactly apache computes the e-tag for a certain resource? Does it compute that when there is

Re: Is Apache 1.3.x deprecated

2011-09-21 Thread Reindl Harald
in short: everybody who is using 1.3 must have sleeped the last years 2.0 will be legacy a year after 2.4 is released what maybe happens this year or at the begin of 2012 if a software is EOL and removed from the start-page anybody should consider upgrades Am 21.09.2011 23:29, schrieb Aalok

Re: [Vote] httpd 2.2.21 release

2011-09-10 Thread Reindl Harald
Am 09.09.2011 18:10, schrieb William A. Rowe Jr.: Candidate binaries are available from http://httpd.apache.org/dev/dist/ which do not yet constitute ASF releases. win32-x86 binary distribution will follow shortly. This will be a 72 hour vote, which ends no later than Noon ET Monday

Re: CVE-2003-1418 - still affects apache 2 current

2011-09-02 Thread Reindl Harald
Am 02.09.2011 09:39, schrieb Florian Weimer: * Reindl Harald: mtime - well, is directly in the header - Last-Modified size - well, directly in the header - Content-Length inode - well, where is there any security implication? I guess you could use it to form an NFS handle, and use

Re: Wrapup -- Was: 2.2 approach for byterange?

2011-08-29 Thread Reindl Harald
Am 29.08.2011 22:41, schrieb William A. Rowe Jr.: On 8/29/2011 3:31 PM, Stefan Fritsch wrote: Jim offered to RM 2.2.20, but I don't know what timezone he is in. If 2.2.20 doesn't happen today, it may be good to publish the patch in an update to the advisory. But I am in the wrong timezone

Re: DoS with mod_deflate range requests

2011-08-23 Thread Reindl Harald
Am 23.08.2011 20:52, schrieb Mohamed Dawaina: please tell me how to unsubscribe from this mailing list what about looking in the mail-header or login with your acount you have registered? Precedence: bulk Reply-To: dev@httpd.apache.org list-help: mailto:dev-h...@httpd.apache.org

Re: With IP address in Host: header ServerName/ServerAlias doesn't work

2011-08-22 Thread Reindl Harald
Am 22.08.2011 18:54, schrieb Micha Lenk: Hi Rüdiger, On 08/22/2011 06:39 PM CEST +02:00, Plüm, Rüdiger, VF-Group wrote: Sorry, I missed the ServerAlias for the IP in the second virtual host. So, yes in general the second virtual host should be hit. But using IP addresses as Serveralias is

-DUSE_STAT_CACHE -DSTAT_CACHE_SIZE, -DSTAT_CACHE_TIME

2011-08-16 Thread Reindl Harald
Are these patches included upstream or anyhow relevant for 2.2.x? http://www.rocg.uta4you.at/manual/misc/perf-mja.html signature.asc Description: OpenPGP digital signature

Re: warning from dev@httpd.apache.org

2011-08-11 Thread Reindl Harald
to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. h.rei...@thelounge.net: 91.118.73.20 failed after I sent the message. Remote host said: 554 rejected due to virus -- Mit besten Grüßen, Reindl Harald the lounge interactive design GmbH A-1060 Vienna

Re: Uploading files to a server

2011-05-31 Thread Reindl Harald
Am 31.05.2011 20:56, schrieb rascle: I have 2 servers, one that I pay for and is hosted by a company where I store all my php files, and a home server where I store all my music, word documents etc to be used by my website (hosted on the virtual server). However I was wondering if I could

Re: Security Issues

2011-05-30 Thread Reindl Harald
Am 30.05.2011 20:22, schrieb rascle: I am wondering if this will lead to any extra risk towards the 2 personal computers or if it is only the server which is at risk? if you forward port 80 only to the server the other machines are not affected as long nobody hacks your server and gets full

Re: 2.2.19 (and probably earlier) won't let you make non-ssl vhosts on 443?

2011-05-26 Thread Reindl Harald
Am 26.05.2011 11:10, schrieb Issac Goldstand: I just upgraded a machine from 2.2.8 to 2.2.19 and suddenly Apache wouldn't let me run non-SSL vhosts on port 443. A snippet like below: VirtualHost a.b.c.d:443 DocumentRoot /home/foo/httpdocs ServerName foo Directory /home/foo/httpdocs/

Re: [Vote] httpd 2.2.19 release

2011-05-22 Thread Reindl Harald
Am 22.05.2011 18:39, schrieb Jim Jagielski: +1 On May 20, 2011, at 1:17 PM, William A. Rowe Jr. wrote: i think the vote is over after final release :-) [harry@srv-rhsoft:~]$ rpm -qa | grep httpd httpd-2.2.19-2.fc14.rh.20110521.x86_64 httpd-tools-2.2.19-2.fc14.rh.20110521.x86_64

Re: mod_rewrite: no path in error-log

2011-04-25 Thread Reindl Harald
Am 25.04.2011 20:30, schrieb Stefan Fritsch: On Sunday 24 April 2011, Reindl Harald wrote: this warnings are useless as long there is no hint where the rule is defined - the host has 200 domains and somebody did somewhere something wrong :-( True. Fixed in trunk in r1096551 Thank you

mod_rewrite: no path in error-log

2011-04-24 Thread Reindl Harald
this warnings are useless as long there is no hint where the rule is defined - the host has 200 domains and somebody did somewhere something wrong :-( it is normal to use a central error-log becuase nobody can look in hundrets of them each day [Sun Apr 24 18:09:25 2011] [warn] RewriteCond:

Re: PHP5.3.6

2011-04-15 Thread Reindl Harald
Am 15.04.2011 23:01, schrieb Jeff Trawick: FastCGI is a way to get us out of all sorts of dark alleys; let's be sure to keep it in mind as one of the tools to address binary compatibility issues, PHP-centered or not but you can not use .htaccess with cgi what is the main reason using

httpd 2.4: mod_ratelimit

2011-03-21 Thread Reindl Harald
, Reindl Harald the lounge interactive design GmbH A-1060 Vienna, Hofmühlgasse 17 CTO / software-development / cms-solutions p: +43 (1) 595 3999 33, m: +43 (676) 40 221 40 icq: 154546673, http://www.thelounge.net/ signature.asc Description: OpenPGP digital signature

<    1   2   3