Re: POOR support for layer 7 security in OBSD. Options or another OS?

2009-11-12 Thread Stuart Henderson
On 2009-11-12, David Taveras d3taveras3...@gmail.com wrote: Hi, On Wed, Nov 11, 2009 at 9:38 PM, Jason Dixon ja...@dixongroup.net wrote: There are plenty of L7 tools in OpenBSD base and ports/packages to help you reach your goals. It's up to you to deploy and configure them properly for

POOR support for layer 7 security in OBSD. Options or another OS?

2009-11-11 Thread David Taveras
I love OpenBSD focused security in many areas, and in the ones not included in base there are always options in packages. However specifically speaking about the options to complement as an application level firewall seems it is truly underestimated the way I see it: What is the option for a web

Re: POOR support for layer 7 security in OBSD. Options or another OS?

2009-11-11 Thread Jason Dixon
On Wed, Nov 11, 2009 at 09:25:45PM -0600, David Taveras wrote: I love OpenBSD focused security in many areas, and in the ones not included in base there are always options in packages. However specifically speaking about the options to complement as an application level firewall seems it is

Re: POOR support for layer 7 security in OBSD. Options or another OS?

2009-11-11 Thread Theo de Raadt
Indeed, mod_security is only currently available for apache-1.3. But I think the lack of modsecurity-2.x is only because nobody has stepped up to complete the port, not because of any technical hurdles. As i said, modsecurity 2 is only compatible with apache2, otherwise I would be able

Re: POOR support for layer 7 security in OBSD. Options or another OS?

2009-11-11 Thread David Taveras
Hi, On Wed, Nov 11, 2009 at 9:38 PM, Jason Dixon ja...@dixongroup.net wrote: There are plenty of L7 tools in OpenBSD base and ports/packages to help you reach your goals. It's up to you to deploy and configure them properly for your environment. Just a few off the top of my head: relayd(8)

Re: POOR support for layer 7 security in OBSD. Options or another OS?

2009-11-11 Thread David Taveras
Hello Theo, On Wed, Nov 11, 2009 at 10:15 PM, Theo de Raadt dera...@cvs.openbsd.org wrote: Well perhaps more people should have gotten upset when Apache started adding contract law language to their copyright notice. Yes, I understand the fundamentals of this decision which in turn gives us an