Re: vote on concept of ServerTokens Off

2009-09-08 Thread Issac Goldstand
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 William A. Rowe, Jr. wrote: > > Guenter, please confirm if you are casting a veto, or in light of > this earlier discussion and rationale, you are just expressing your > standing distaste for the patch (which is -0)? For the record, I also agree with

[VOTE] release httpd mod_fcgid-2.3.1?

2009-09-08 Thread William A. Rowe, Jr.
mod_fcgid freinds; Please fetch up the newly minted mod_fcgid-2.3.1.tar.gz (or bz2) or the win32 suitable package mod_fcgid-2.3.1-crlf.zip from: http://httpd.apache.org/dev/dist/mod_fcgid/ review, take it for a spin, and cast your choice [ ] -1 for any release of 2.3.1 (regressed from 2.3.0

[VOTE] release httpd mod_ftp-0.9.5 beta?

2009-09-08 Thread William A. Rowe, Jr.
Let's see if this is it... Please fetch up the newly prepared mod_ftp-0.9.5.tar.gz (or .bz2), or the win32/netware/os2 suitable package mod_ftp-0.9.5-crlf.zip from; http://httpd.apache.org/dev/dist/mod_ftp/ review, take it for a spin, and cast your choice [ ] -1 for any release of 0.9.5 (re

Re: vote on concept of ServerTokens Off

2009-09-08 Thread William A. Rowe, Jr.
William A. Rowe, Jr. wrote: > Guenter Knauf wrote: >> Hi, >> William A. Rowe, Jr. schrieb: >>> Jim Jagielski wrote: Lars Eilebrecht wrote: > According to Jeff: > >> A lot of opinions were offered back in August. Some were negative but >> I don't see anything that looks like a

A question about hook calling order

2009-09-08 Thread Eldar Gaynetdinov
Hi, I want to write tiny module which measure cpu time (on unix like system) for each request and write down values into the log. I think implement it by getrusage(). First hook (e.g. ap_hook_post_read_request) in this module should be called before the same hook in any other modules (I think

Re: X.509 client certificates and LDAP authorization

2009-09-08 Thread Eric Covener
On Tue, Sep 8, 2009 at 11:01 AM, Udo Rader wrote: > Typically, certificate based authentication needs to be "supported" by LDAP, > the latter translating the certificate subjects into "real" usernames, > useable by external applications via REMOTE_USER. A change to mod_ssl to allow SSLUserName-lik

Re: X.509 client certificates and LDAP authorization

2009-09-08 Thread Paul J. Reder
Technically what's being attempted here is a lookup rather than authentication. The intention is to do a query using the cert info to get back the uid from LDAP (as opposed to an LDAP connect with a password followed by a query). Currently the LDAP code only provides Authentication and/or Author

Re: X.509 client certificates and LDAP authorization

2009-09-08 Thread Udo Rader
Graham Leggett wrote: Udo Rader wrote: Maybe a more concrete sample can help clarify what I am talking about, here's my approximate setup: SSLVerifyClient require SSLRequireSSL SSLOptions +FakeBasicAuth AuthName "Snake Oil Authentication" AuthType Basic AuthBasicProvider ldap A

Re: X.509 client certificates and LDAP authorization

2009-09-08 Thread Graham Leggett
Udo Rader wrote: > Maybe a more concrete sample can help clarify what I am talking about, > here's my approximate setup: > > > SSLVerifyClient require > SSLRequireSSL > > SSLOptions +FakeBasicAuth > AuthName "Snake Oil Authentication" > AuthType Basic > AuthBasicProvider ldap > Au

Re: X.509 client certificates and LDAP authorization

2009-09-08 Thread Udo Rader
Eric Covener wrote: On Tue, Sep 8, 2009 at 10:09 AM, Udo Rader wrote: Graham Leggett wrote: SSLOptions +FakeBasicAuth AuthName "Snake Oil Authentication" AuthType Basic AuthBasicProvider ldap AuthLDAPRemoteUserAttribute uid AuthLDAPURL ldap://127.0.0.1/dc=example,dc=com?subjectDN?one req

Re: X.509 client certificates and LDAP authorization

2009-09-08 Thread Eric Covener
On Tue, Sep 8, 2009 at 10:09 AM, Udo Rader wrote: > Graham Leggett wrote: >> >  SSLOptions +FakeBasicAuth >  AuthName "Snake Oil Authentication" >  AuthType Basic >  AuthBasicProvider ldap >  AuthLDAPRemoteUserAttribute uid > >  AuthLDAPURL ldap://127.0.0.1/dc=example,dc=com?subjectDN?one >  requir

Re: X.509 client certificates and LDAP authorization

2009-09-08 Thread Udo Rader
Graham Leggett wrote: Udo Rader wrote: I am just trying to set up a X.509 client certificates + LDAP based authorizaton system. I've setup all pieces best to my knowledge (mod_ssl, mod_auth_basic, mod_auth_ldap), but I am still having problems to connect to our LDAP server because "SSLOption F

Re: mod_reqtimeout: mitigating against slowloris-style attack (different approach)

2009-09-08 Thread Rainer Jung
On 06.09.2009 22:38, Stefan Fritsch wrote: > On Tuesday 01 September 2009, Ruediger Pluem wrote: >> I guess >> >> reqtimeout_after_body >> >> also needs to be updated to the assert / do nothing if not >> configured logic like reqtimeout_after_headers >> > > Thanks, I missed that. I fixed it and a

Re: X.509 client certificates and LDAP authorization

2009-09-08 Thread Graham Leggett
Udo Rader wrote: > I am just trying to set up a X.509 client certificates + LDAP based > authorizaton system. > > I've setup all pieces best to my knowledge (mod_ssl, mod_auth_basic, > mod_auth_ldap), but I am still having problems to connect to our LDAP > server because "SSLOption FakeBasicAuth"

Re: svn commit: r811806 - in /httpd/httpd/trunk: CHANGES docs/man/ab.8 support/ab.c

2009-09-08 Thread William A. Rowe, Jr.
Jeff Barnes wrote: > I obsoleted the .8 file and attached the svn diff for the xml file. > > Should the ab.8 file be removed from svn if it gets overwritten with each > documentation generation? No moreso than the .html files, all generated from xml. We don't expect typical developers to instal