Your message dated Fri, 05 Apr 2024 04:34:28 +0000
with message-id <e1rsbhy-00ddtl...@fasolo.debian.org>
and subject line Bug#1054564: fixed in apache2 2.4.59-1
has caused the Debian Bug report #1054564,
regarding apache2: mod_proxy_connect insecure default server-wide AllowCONNECT
value
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
1054564: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054564
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: apache2
Version: 2.4.56-1~deb11u2
Severity: normal
X-Debbugs-Cc: raphael.d...@gmail.com
Dear Maintainer,
# Context
For years, one of my SSL vhost (on :443) has been relying mod_proxy_http to
(safely)
forward some requests to a backend, acting as a reverse-proxy.
```
# Something like
ProxyRequests On
SSLProxyEngine On
RewriteRule ^/.well-known/.*$ "https://gitlab-foobar/%{REQUEST_URI}"; [P,L]
```
Recently, I experienced the need to (safely) forward some requests (from
another server I own)
through this server (because of some network/geoblocking problem).
I enabled `mod_proxy_connect` and (safely) configured a forward-proxy on :80
(using `Require valid-user / ip`).
```
# Something like
ProxyRequests On
Authtype Basic
AuthUserFile ...
<RequireAll>
p Require valid-user
Require ip ...
</RequireAll>
```
# Problem
While this :80 forward-proxy vhost was secure, I later discovered, that
the original (and almost forgotten) vhost had incidentally become an
open-proxy (!)
The reasons are:
- mod_proxy_connect is globally enabled (affects all vhosts)
- AllowCONNECT defaults to "443 563" (affects all vhosts)
Said otherwise, *any* secure reverse-proxy vhost configuration become de-facto
an insecure open forward-proxy vhost as soon as `mod_proxy_connect` is
globally enabled.
This sounds contrary to best security practices.
(and I bet more than one server out there is silently affected by this
insecure-by-default
configuration)
# Proposed solution
I suggest to add a server-wide `AllowCONNECT 0` directive inside
`/etc/apache2/mods-available/proxy_connect.load` (virtually disabling CONNECT)
so that individual vhosts relying on it would have to explicitely set the value
at the vhost-level.
It would be more logical (scope/side-effects) and avoid holes being punched
into existing
(and otherwise secure) reverse-proxy vhosts.
# Additional notes
To cap it all my proxy-enabled vhost was the first one (lexicographically
speaking) making it the destination of all the random internet SSL traffic
scanners.
Google-friendly list of typical log messages that should raise flags:
> AH00898: Connect to remote machine blocked returned by...
> AH00939: CONNECT: attempt to connect to ...:443 (...) failed
> AH10221: proxy: CONNECT: client flushing failed (-102)
> AH10221: proxy: CONNECT: origin flushing failed (-102)
-- Package-specific info:
-- System Information:
Debian Release: bullseye
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 6.2.0-35-generic (SMP w/4 CPU threads; PREEMPT)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages apache2 depends on:
ii apache2-bin 2.4.56-1~deb11u2
ii apache2-data 2.4.56-1~deb11u2
ii apache2-utils 2.4.56-1~deb11u2
Versions of packages apache2 recommends:
pn ssl-cert <none>
Versions of packages apache2 suggests:
pn apache2-doc <none>
pn apache2-suexec-pristine | apache2-suexec <none>
Versions of packages apache2 is related to:
ii apache2 2.4.56-1~deb11u2
ii apache2-bin 2.4.56-1~deb11u2
-- Configuration Files:
/etc/apache2/apache2.conf changed [not included]
-- no debconf information
--
GPG id: 0xF41572CEBD4218F4
--- End Message ---
--- Begin Message ---
Source: apache2
Source-Version: 2.4.59-1
Done: Yadd <y...@debian.org>
We believe that the bug you reported is fixed in the latest version of
apache2, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1054...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Yadd <y...@debian.org> (supplier of updated apache2 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 05 Apr 2024 08:08:11 +0400
Source: apache2
Built-For-Profiles: nocheck
Architecture: source
Version: 2.4.59-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Apache Maintainers <debian-apache@lists.debian.org>
Changed-By: Yadd <y...@debian.org>
Closes: 1032628 1054564
Changes:
apache2 (2.4.59-1) unstable; urgency=medium
.
[ Stefan Fritsch ]
* Remove old transitional packages libapache2-mod-md and
libapache2-mod-proxy-uwsgi. Closes: #1032628
.
[ Yadd ]
* mod_proxy_connect: disable AllowCONNECT by default (Closes: #1054564)
* Refresh patches
* New upstream version 2.4.59
* Refresh patches
* Update patches
* Update test framework
Checksums-Sha1:
f1cf18103ca23c57beaa2985bbbe4eee1e8dff87 3334 apache2_2.4.59-1.dsc
7a118baaed0f2131e482f93f5057038ca6c021be 9843252 apache2_2.4.59.orig.tar.gz
837cdf46898d962c4c05642745566249fc91e52b 833 apache2_2.4.59.orig.tar.gz.asc
3e1cad5ee1fc66d350465c1e81d7e0f88221bc01 820300 apache2_2.4.59-1.debian.tar.xz
Checksums-Sha256:
25e6990e65cb685f3172143648806ab0fd263a18cd412155f0d14d7ef9987428 3334
apache2_2.4.59-1.dsc
e4ec4ce12c6c8f5a794dc2263d126cb1d6ef667f034c4678ec945d61286e8b0f 9843252
apache2_2.4.59.orig.tar.gz
0ad3f670b944ebf08c81544bc82fae9496e88d96840cd0612d8cdeaa073eb06d 833
apache2_2.4.59.orig.tar.gz.asc
1e869a5024215a2a9b69603daf1395840774640f7b2701ca4b7971452a0641d1 820300
apache2_2.4.59-1.debian.tar.xz
Files:
3f3ee286b583f22ec5cb3efc1f0a5016 3334 httpd optional apache2_2.4.59-1.dsc
c39d28e0777bc95631cb49958fdb6601 9843252 httpd optional
apache2_2.4.59.orig.tar.gz
3c342b3dcc0fe227a1fffdf9997987d0 833 httpd optional
apache2_2.4.59.orig.tar.gz.asc
4da024370ede9c5a75a0df725be0cdc5 820300 httpd optional
apache2_2.4.59-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmYPec8ACgkQ9tdMp8mZ
7umCiw//TB1rIA1czwHsUrdeOIT3HG9qERzBJsmsP8nyg+cIrytiGfhlt2eOmLYO
X+Wo19J98VuCmTbJClb6opAfSpvJG2AmNUl/PYAqOBzvDgR+QlEMmVXVgxUp9+Tv
0e0P2H+8U0pO3dE51VIXqYtCLTLQnLaci763ewB0oRlSWuzoVNDDahUS3iJ5e58o
btwUQQwq+2F+RBclRhuXca3dOI93UBZDsv56mxR+p2o0vpo+pQRZjHDv8tzT3bOq
/PyWusXKPDf9MXYZqwY2TgYx8v/YdDVYqzgr6Tj/VXgXEKC22pudzSv9/J5iGfHh
VHmf02Gh+0wNWmxajqK2KlxjMON/Qn6kyoAok9w5vv4HtOXBZimzdq0kDsc8EjJl
QuaBcwIAy+0EATBhjaVY7sHtM9SydJNr1f4DBBD9kEB2DKEE9n7/iFxcFfSMd52Y
xwJ4fPk1fe1ki7k/qn0VULpzf1iM3JDQE19uXyE29cSW4eJhiWvH1v+NZzzxNo+t
NtDhSIEEnUkGZSsYyg2qg5NH3e3PJMadc1nTRY6hVNzGpJlsUrCKnMOZbJsBQM6S
cNCY48ux8ziQmJNowvBVbXf6/+SH9h2+CYFRw9GZagaNe1yfErNglbn78KZqJUHw
YcXIFc96qeznRJ9zRhPdHGGeqa+nETH1lWBp6eitihkKhDjCF48=
=dQDE
-----END PGP SIGNATURE-----
pgpShVLwaVMBn.pgp
Description: PGP signature
--- End Message ---
