[Bug 1853021] Re: ssl-cert generate-default-snakeoil provides no way to override default 10 year expiration or reduce to 825 day expiration

2020-11-21 Thread Stefan Fritsch
The link at [1] does not talk about self-signed certificates at all, only about DV and OV certificates. I agree that make-ssl-cert should have an option for the life time of the generated certificate, but I don't think that 825 days should be the default for 'generate-default- snakeoil'. If you

[Bug 1566519] Re: Please add native systemd units

2016-04-10 Thread Stefan Fritsch
>From looking at the patch, I have a few comments/questions: - Don't you have to name the service exactly like the init script, apache-htcacheclean, to make sure it overrides the init script? - You should depend on network-online.target . Apache may not start if some IPs are not yet configured.

[Bug 1468822] Re: Apache 2.4.7 does not set environment vars. Checked with "Apache2 -V" just after installation.

2016-03-27 Thread Stefan Fritsch
** Changed in: apache2 (Ubuntu) Status: Incomplete => Invalid -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1468822 Title: Apache 2.4.7 does not set environment vars. Checked with "Apache2

[Bug 1468822] Re: Apache 2.4.7 does not set environment vars. Checked with "Apache2 -V" just after installation.

2016-03-27 Thread Stefan Fritsch
** Changed in: apache2 (Ubuntu) Status: Incomplete => Invalid -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to apache2 in Ubuntu. https://bugs.launchpad.net/bugs/1468822 Title: Apache 2.4.7 does not set environment vars.

[Bug 1556065] Re: I win but i did't get anything and I lost my awp

2016-03-27 Thread Stefan Fritsch
** Changed in: apache2 (Ubuntu) Status: New => Invalid -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1556065 Title: I win but i did't get anything and I lost my awp To manage notifications

[Bug 1468822] Re: Apache 2.4.7 does not set environment vars. Checked with "Apache2 -V" just after installation.

2016-03-27 Thread Stefan Fritsch
Use 'apachectl -V' instead of calling apache2 directly. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to apache2 in Ubuntu. https://bugs.launchpad.net/bugs/1468822 Title: Apache 2.4.7 does not set environment vars. Checked with

[Bug 1556065] Re: I win but i did't get anything and I lost my awp

2016-03-27 Thread Stefan Fritsch
** Changed in: apache2 (Ubuntu) Status: New => Invalid -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to apache2 in Ubuntu. https://bugs.launchpad.net/bugs/1556065 Title: I win but i did't get anything and I lost my awp To

[Bug 1468822] Re: Apache 2.4.7 does not set environment vars. Checked with "Apache2 -V" just after installation.

2016-03-27 Thread Stefan Fritsch
Use 'apachectl -V' instead of calling apache2 directly. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1468822 Title: Apache 2.4.7 does not set environment vars. Checked with "Apache2 -V" just

[Bug 1366174] Re: apache2 SEGV with multiple SSL sites

2014-11-18 Thread Stefan Fritsch
Looks like Vivid will need to either cherry-pick this, or a merge may be sufficient since your message says you picked r1629372, r1629485, r1629519 and Debian 2.4.10-6 reports to have picked everything up to r1632831 but I need to check this. The commits mentioned by Alex are in the trunk

[Bug 1366174] Re: apache2 SEGV with multiple SSL sites

2014-11-18 Thread Stefan Fritsch
Looks like Vivid will need to either cherry-pick this, or a merge may be sufficient since your message says you picked r1629372, r1629485, r1629519 and Debian 2.4.10-6 reports to have picked everything up to r1632831 but I need to check this. The commits mentioned by Alex are in the trunk

[Bug 1251939] Re: config*.m4 search path

2014-01-12 Thread Stefan Fritsch
Hi Robie, Am Montag, 6. Januar 2014, 13:01:06 schrieb Robie Basak: I'm wondering if there's more of a potential issue in Ubuntu than in Debian here. Our next release will be supported for five years, so I expect that we'll backport a number of as-yet-unknown bug fixes. As we're team based, it

[Bug 1251939] Re: config*.m4 search path

2014-01-12 Thread Stefan Fritsch
Hi Robie, Am Montag, 6. Januar 2014, 13:01:06 schrieb Robie Basak: I'm wondering if there's more of a potential issue in Ubuntu than in Debian here. Our next release will be supported for five years, so I expect that we'll backport a number of as-yet-unknown bug fixes. As we're team based, it

[Bug 1251939] Re: config*.m4 search path

2014-01-04 Thread Stefan Fritsch
Hi Robie, Am Freitag, 3. Januar 2014, 16:53:26 schrieb Robie Basak: I'm merging apache2 2.4.7-1 from Debian into Ubuntu, but I can't find the fix in Debian for this issue. The upstream fix doesn't seem to be present, and I tried dropping a config*.m4 file into .pc/ and the configfiles= line

[Bug 1251939] Re: config*.m4 search path

2014-01-04 Thread Stefan Fritsch
Hi Robie, Am Freitag, 3. Januar 2014, 16:53:26 schrieb Robie Basak: I'm merging apache2 2.4.7-1 from Debian into Ubuntu, but I can't find the fix in Debian for this issue. The upstream fix doesn't seem to be present, and I tried dropping a config*.m4 file into .pc/ and the configfiles= line

[Bug 1251939] Re: Chroot fails with Cannot chroot when not started as root error

2013-11-17 Thread Stefan Fritsch
If you fix that, you also need to regenerate debian/patches/itk-rerun- configure.patch after the upstream patch has been applied . I have done that in the attached patch. I would recommend that you do that for saucy. This will also be fixed in 2.4.6-4, which will be uploaded to Debian soon.

[Bug 1251939] Re: Chroot fails with Cannot chroot when not started as root error

2013-11-17 Thread Stefan Fritsch
If you fix that, you also need to regenerate debian/patches/itk-rerun- configure.patch after the upstream patch has been applied . I have done that in the attached patch. I would recommend that you do that for saucy. This will also be fixed in 2.4.6-4, which will be uploaded to Debian soon.

[Bug 1232469] Re: Apache coredump when started with dbd and php5 enabled

2013-11-09 Thread Stefan Fritsch
I can reproduce this on Debian sid. Somehow openssl's int_free_ex_data() calls a free_func that points into nirvana. I guess this may be due to all the libraries being loaded, unloaded and then loaded again during apache config parsing. Some library using ssl may do the wrong thing during

[Bug 1232469] Re: Apache coredump when started with dbd and php5 enabled

2013-11-09 Thread Stefan Fritsch
I can reproduce this on Debian sid. Somehow openssl's int_free_ex_data() calls a free_func that points into nirvana. I guess this may be due to all the libraries being loaded, unloaded and then loaded again during apache config parsing. Some library using ssl may do the wrong thing during

[Bug 1207384] Re: apache2 failure to start on boot when binding to IPv6 address

2013-08-02 Thread Stefan Fritsch
I don't think this should be fixed in apache'2 init script. It depends on '$network' and whatever is providing $network must ensure that the network is actually usable. Also, it makes much more sense to fix this in one place instead of hundreds of network daemons which are affected by the same

[Bug 1207384] Re: apache2 failure to start on boot when binding to IPv6 address

2013-08-02 Thread Stefan Fritsch
I don't think this should be fixed in apache'2 init script. It depends on '$network' and whatever is providing $network must ensure that the network is actually usable. Also, it makes much more sense to fix this in one place instead of hundreds of network daemons which are affected by the same

[Bug 1203541] [NEW] Include output of bug script in crash reports

2013-07-21 Thread Stefan Fritsch
Public bug reported: Debian's apache2 package contains /usr/share/bug/apache2/script (actually it's a link to .../apache2-bin/script) which gives useful output for crash bug reports. It would be nice if apport could include the output of that script when reporting a crash report. Or maybe that

[Bug 1203541] [NEW] Include output of bug script in crash reports

2013-07-21 Thread Stefan Fritsch
Public bug reported: Debian's apache2 package contains /usr/share/bug/apache2/script (actually it's a link to .../apache2-bin/script) which gives useful output for crash bug reports. It would be nice if apport could include the output of that script when reporting a crash report. Or maybe that

[Bug 1202655] Re: apache2 crashed with SIGABRT in do_fcntl()

2013-07-20 Thread Stefan Fritsch
The StacktraceTop shown above is not actually the top of the stack. It looks like apache is shutting down and mod_wsgi is crashing during shutdown. #2 0x7f383822c6ee in Py_FatalError () from /tmp/apport_sandbox_EBD2sJ/usr/lib/x86_64-linux-gnu/libpython2.7.so.1.0 No symbol table info

[Bug 1202655] Re: mod_wsgi crashes during shutdown

2013-07-20 Thread Stefan Fritsch
** Summary changed: - apache2 crashed with SIGABRT in do_fcntl() + mod_wsgi crashes during shutdown ** Package changed: apache2 (Ubuntu) = mod-wsgi (Ubuntu) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to apache2 in Ubuntu.

[Bug 1202655] Re: apache2 crashed with SIGABRT in do_fcntl()

2013-07-20 Thread Stefan Fritsch
The StacktraceTop shown above is not actually the top of the stack. It looks like apache is shutting down and mod_wsgi is crashing during shutdown. #2 0x7f383822c6ee in Py_FatalError () from /tmp/apport_sandbox_EBD2sJ/usr/lib/x86_64-linux-gnu/libpython2.7.so.1.0 No symbol table info

[Bug 1202655] Re: mod_wsgi crashes during shutdown

2013-07-20 Thread Stefan Fritsch
** Summary changed: - apache2 crashed with SIGABRT in do_fcntl() + mod_wsgi crashes during shutdown ** Package changed: apache2 (Ubuntu) = mod-wsgi (Ubuntu) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu.

[Bug 1028470] Re: apache2+ssl hangs on high load

2012-07-26 Thread Stefan Fritsch
Evgeny, you can use netstat -tnp |grep curl to get the other port number of the connection from curl to apache2. With that, you can look for the other end of the connection in netstat -tnp output. The last column should give be 123/apache2 where 123 is the pid of the apache2 process. You will

[Bug 1028470] Re: apache2+ssl hangs on high load

2012-07-26 Thread Stefan Fritsch
Evgeny, you can use netstat -tnp |grep curl to get the other port number of the connection from curl to apache2. With that, you can look for the other end of the connection in netstat -tnp output. The last column should give be 123/apache2 where 123 is the pid of the apache2 process. You will

[Bug 1028204] Re: /etc/apache2/sites-available/default-ssl contain a regex error at line 169

2012-07-25 Thread Stefan Fritsch
No, the regex is correct. It matches MSIE 7 to 9 and 10 to 19 ** Changed in: apache2 (Ubuntu) Status: New = Invalid -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to apache2 in Ubuntu. https://bugs.launchpad.net/bugs/1028204

[Bug 1028470] Re: apache2+ssl hangs on high load

2012-07-25 Thread Stefan Fritsch
I cannot reproduce this on Debian unstable with either 2.2.22-9 or 2.2.22-1. Wild guess: Do you have a per-user process limit configured in /etc/security/limits.conf ? If no, it would be helpful if you could provide a backtrace of the process that curl connects to and hangs. There is some

[Bug 1028204] Re: /etc/apache2/sites-available/default-ssl contain a regex error at line 169

2012-07-25 Thread Stefan Fritsch
No, the regex is correct. It matches MSIE 7 to 9 and 10 to 19 ** Changed in: apache2 (Ubuntu) Status: New = Invalid -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1028204 Title:

[Bug 1028470] Re: apache2+ssl hangs on high load

2012-07-25 Thread Stefan Fritsch
I cannot reproduce this on Debian unstable with either 2.2.22-9 or 2.2.22-1. Wild guess: Do you have a per-user process limit configured in /etc/security/limits.conf ? If no, it would be helpful if you could provide a backtrace of the process that curl connects to and hangs. There is some

[Bug 988819] Re: [SRU] wrong path to libxml2.so.2 in mod_security - broken by multiarch enabled libraries

2012-07-04 Thread Stefan Fritsch
There are two schools of thought here. Some people prefer linking to the libraries directly (the saner approach for a Linux distribution) and some people prefer to load depending libraries with LoadFile (to make it easier to avoid loading to different versions of the same library in the same

[Bug 988819] Re: [SRU] wrong path to libxml2.so.2 in mod_security - broken by multiarch enabled libraries

2012-07-04 Thread Stefan Fritsch
There are two schools of thought here. Some people prefer linking to the libraries directly (the saner approach for a Linux distribution) and some people prefer to load depending libraries with LoadFile (to make it easier to avoid loading to different versions of the same library in the same

[Bug 1018285] Re: Redirects incorrectly set Location header in response when Host header is set in request

2012-06-29 Thread Stefan Fritsch
Are you sure you have the same configuration for all versions? The behavior is defined by UseCanonicalName and UseCanonicalPhysicalPort: http://httpd.apache.org/docs/2.2/mod/core.html#usecanonicalphysicalport The behavior you describe for 2.2.22-1ubuntu1 seems to match the one for

[Bug 1018285] Re: Redirects incorrectly set Location header in response when Host header is set in request

2012-06-29 Thread Stefan Fritsch
Are you sure you have the same configuration for all versions? The behavior is defined by UseCanonicalName and UseCanonicalPhysicalPort: http://httpd.apache.org/docs/2.2/mod/core.html#usecanonicalphysicalport The behavior you describe for 2.2.22-1ubuntu1 seems to match the one for

[Bug 917832] Re: init script and upstart job named apache2.1 instead apache2

2012-01-17 Thread Stefan Fritsch
This is likely this bug in logrotate: https://bugs.launchpad.net/ubuntu/+source/logrotate/+bug/387189 According to that bug it should be fixed in lucid, though. Do you have logrotate 3.7.8-4ubuntu2.1 or newer installed? Some more information is available here:

[Bug 917832] Re: init script and upstart job named apache2.1 instead apache2

2012-01-17 Thread Stefan Fritsch
This is likely this bug in logrotate: https://bugs.launchpad.net/ubuntu/+source/logrotate/+bug/387189 According to that bug it should be fixed in lucid, though. Do you have logrotate 3.7.8-4ubuntu2.1 or newer installed? Some more information is available here:

[Bug 897120] Re: apache2-suexec-custom changes permissions on suexec binary

2011-12-03 Thread Stefan Fritsch
That's what dpkg-statoverride is for. I will mention that in the suexec man page. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to apache2 in Ubuntu. https://bugs.launchpad.net/bugs/897120 Title: apache2-suexec-custom changes

[Bug 897120] Re: apache2-suexec-custom changes permissions on suexec binary

2011-12-03 Thread Stefan Fritsch
That's what dpkg-statoverride is for. I will mention that in the suexec man page. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/897120 Title: apache2-suexec-custom changes permissions on suexec

[Bug 890219] Re: suexec-custom is not working correctly: only reading the www-data user config file.

2011-11-18 Thread Stefan Fritsch
What you want to achieve is out of scope of apache2-suexec-custom. The filename in /etc/apache2/suexec is the name of the run user of apache2, i.e. whatever is specified as 'User' in /etc/apache2/apache2.conf. Or put it differently, that's the user suexec changes from, while SuexecUserGroup

[Bug 890219] Re: suexec-custom is not working correctly: only reading the www-data user config file.

2011-11-18 Thread Stefan Fritsch
What you want to achieve is out of scope of apache2-suexec-custom. The filename in /etc/apache2/suexec is the name of the run user of apache2, i.e. whatever is specified as 'User' in /etc/apache2/apache2.conf. Or put it differently, that's the user suexec changes from, while SuexecUserGroup

[Bug 839569] Re: Apache2 is still Range header DoS vulnerable if gzip compression is enabled

2011-09-07 Thread Stefan Fritsch
Note that it is impossible to determine from apache's response alone if apache is vulnerable or not. The only way to check it is to do a request with lots of overlapping ranges (like killapache does) and check if the process size increases a lot or not. On 32bit machines, the original

[Bug 839569] Re: Apache2 is still Range header DoS vulnerable if gzip compression is enabled

2011-09-07 Thread Stefan Fritsch
Note that it is impossible to determine from apache's response alone if apache is vulnerable or not. The only way to check it is to do a request with lots of overlapping ranges (like killapache does) and check if the process size increases a lot or not. On 32bit machines, the original

[Bug 811428] Re: Apache does not honor -FollowSymlinks due to TOCTOU, which allows access to /proc/pid/ files

2011-07-24 Thread Stefan Fritsch
This is an unsupported use-case of Apache httpd and I am pretty sure it won't be changed upstream. And I don't think Ubuntu or Debian should deviate from that, see http://seclists.org/oss-sec/2011/q3/111 ** Changed in: apache2 (Ubuntu) Status: New = Invalid -- You received this bug

[Bug 811428] Re: Apache does not honor -FollowSymlinks due to TOCTOU, which allows access to /proc/pid/ files

2011-07-24 Thread Stefan Fritsch
This is an unsupported use-case of Apache httpd and I am pretty sure it won't be changed upstream. And I don't think Ubuntu or Debian should deviate from that, see http://seclists.org/oss-sec/2011/q3/111 ** Changed in: apache2 (Ubuntu) Status: New = Invalid -- You received this bug

[Bug 711465] Re: mod_rewrite directives in Location section confusingly disable rewrites in .htaccess

2011-02-01 Thread Stefan Fritsch
I think you were only missing RewriteOptions inherit. Without that, only the last set of RewriteRules are executed, and Location comes after .htaccess. Can you try that? -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to apache2 in

[Bug 711465] Re: mod_rewrite directives in Location section confusingly disable rewrites in .htaccess

2011-02-01 Thread Stefan Fritsch
I think you were only missing RewriteOptions inherit. Without that, only the last set of RewriteRules are executed, and Location comes after .htaccess. Can you try that? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu.

[Bug 387189] Re: /dev/null corrupted (/dev/null.1)

2011-01-30 Thread Stefan Fritsch
This is a logrotate issue and happens if the specified logfile directory (in this case /var/log/apache2) does not exist and the postrotate script contains a closing '}'. Therefore I don't think Jonathan's patch would fix the issue completely. The full info is at http://bugs.debian.org/cgi-

[Bug 387189] Re: /dev/null corrupted (/dev/null.1)

2011-01-30 Thread Stefan Fritsch
This is a logrotate issue and happens if the specified logfile directory (in this case /var/log/apache2) does not exist and the postrotate script contains a closing '}'. Therefore I don't think Jonathan's patch would fix the issue completely. The full info is at http://bugs.debian.org/cgi-

[Bug 697105] Re: Segfault on POST

2011-01-07 Thread Stefan Fritsch
I haven't really looked into this issue in detail and don't know yet if the proposed fix is ok. But in case you want to ahead with it: Your patch is against the wrong package. srclib/ in apache2 is never compiled. You would have to patch the apr package and rebuild apache2 with the fixed

[Bug 697105] Re: Segfault on POST

2011-01-07 Thread Stefan Fritsch
That's weird indeed. Maybe the package in your PPA and the package in natty were compiled with slightly different versions of gcc? Are the buildlogs available somewhere? -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to apache2 in

[Bug 697105] Re: Segfault on POST

2011-01-07 Thread Stefan Fritsch
I haven't really looked into this issue in detail and don't know yet if the proposed fix is ok. But in case you want to ahead with it: Your patch is against the wrong package. srclib/ in apache2 is never compiled. You would have to patch the apr package and rebuild apache2 with the fixed

[Bug 697105] Re: Segfault on POST

2011-01-07 Thread Stefan Fritsch
That's weird indeed. Maybe the package in your PPA and the package in natty were compiled with slightly different versions of gcc? Are the buildlogs available somewhere? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu.

[Bug 694754] Re: Apache graceful-stop doesn't end apache processes

2010-12-28 Thread Stefan Fritsch
Have you checked with netstat that there are no more open connections? The processes will only die once there are no more open connections. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to apache2 in ubuntu.

[Bug 694754] Re: Apache graceful-stop doesn't end apache processes

2010-12-28 Thread Stefan Fritsch
Have you checked with netstat that there are no more open connections? The processes will only die once there are no more open connections. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/694754 Title:

[Bug 687275] Re: Fix graceful action in init script when mod_chroot is enabled

2010-12-13 Thread Stefan Fritsch
Which version of apache are you using? Since 2.2.10, it supports chroot without additional modules. And if that breaks graceful restart, that should be fixed. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to apache2 in ubuntu.

[Bug 687275] Re: Fix graceful action in init script when mod_chroot is enabled

2010-12-13 Thread Stefan Fritsch
Which version of apache are you using? Since 2.2.10, it supports chroot without additional modules. And if that breaks graceful restart, that should be fixed. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu.

[Bug 633981] Re: apache2 does not listen on ipv6 at all when there is no routable IPv6 address

2010-09-12 Thread Stefan Fritsch
It seems reasonable to not listen on IPv6 if no v6 address is configured. Unfortunately, Apache (or rather APR) does this by using getaddrinfo's AI_ADDRCONFIG flag. And glibc seems to ignore IPv6 addresses of scope host (i.e. ::1) when deciding if an v6 address is configured. For me, the default

[Bug 633981] Re: apache2 does not listen on ipv6 at all when there is no routable IPv6 address

2010-09-12 Thread Stefan Fritsch
** Package changed: apache2 (Ubuntu) = eglibc (Ubuntu) -- apache2 does not listen on ipv6 at all when there is no routable IPv6 address https://bugs.launchpad.net/bugs/633981 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to apache2 in

[Bug 631064] Re: connection forbidden on localhost after wireless connected

2010-09-12 Thread Stefan Fritsch
Thanks for checking, Gerben. Maybe this is related to bug #633981: Can you please check in the output of ip a before and after wireless is connected. Are there any inet6 addresses besides the loop-back entry inet6 ::1/128 scope host? Do you use network manager for connecting to the wireless?

[Bug 626728] Re: typing error in default-ssl

2010-09-12 Thread Stefan Fritsch
Luka, that's correct. MSIE [17-9] matches MSIE 7 to 9 and 10 to 19 (and 1, but that should not be a problem). -- typing error in default-ssl https://bugs.launchpad.net/bugs/626728 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to apache2 in

[Bug 633981] Re: apache2 does not listen on ipv6 at all when there is no routable IPv6 address

2010-09-12 Thread Stefan Fritsch
It seems reasonable to not listen on IPv6 if no v6 address is configured. Unfortunately, Apache (or rather APR) does this by using getaddrinfo's AI_ADDRCONFIG flag. And glibc seems to ignore IPv6 addresses of scope host (i.e. ::1) when deciding if an v6 address is configured. For me, the default

[Bug 633981] Re: apache2 does not listen on ipv6 at all when there is no routable IPv6 address

2010-09-12 Thread Stefan Fritsch
** Package changed: apache2 (Ubuntu) = eglibc (Ubuntu) -- apache2 does not listen on ipv6 at all when there is no routable IPv6 address https://bugs.launchpad.net/bugs/633981 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. --

[Bug 631064] Re: connection forbidden on localhost after wireless connected

2010-09-12 Thread Stefan Fritsch
Thanks for checking, Gerben. Maybe this is related to bug #633981: Can you please check in the output of ip a before and after wireless is connected. Are there any inet6 addresses besides the loop-back entry inet6 ::1/128 scope host? Do you use network manager for connecting to the wireless?

[Bug 626728] Re: typing error in default-ssl

2010-09-12 Thread Stefan Fritsch
Luka, that's correct. MSIE [17-9] matches MSIE 7 to 9 and 10 to 19 (and 1, but that should not be a problem). -- typing error in default-ssl https://bugs.launchpad.net/bugs/626728 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. --

[Bug 582963] Re: SSL pass phrase dialog can't read input

2010-09-08 Thread Stefan Fritsch
Doesn't upstart have a facility to handle this kind of problems? If no, how does e.g. cryptsetup work in Ubuntu? -- SSL pass phrase dialog can't read input https://bugs.launchpad.net/bugs/582963 You received this bug notification because you are a member of Ubuntu Server Team, which is

[Bug 631064] Re: connection forbidden on localhost after wireless connected

2010-09-08 Thread Stefan Fritsch
Gerben, can you please also provide the output of the four commands getent hosts ::1 getent hosts 127.0.0.1 getent hosts localhost getent hosts ip6-localhost both before and after wireless network is configured? Thanks. -- connection forbidden on localhost after wireless connected

[Bug 582963] Re: SSL pass phrase dialog can't read input

2010-09-08 Thread Stefan Fritsch
Doesn't upstart have a facility to handle this kind of problems? If no, how does e.g. cryptsetup work in Ubuntu? -- SSL pass phrase dialog can't read input https://bugs.launchpad.net/bugs/582963 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to

[Bug 631064] Re: connection forbidden on localhost after wireless connected

2010-09-08 Thread Stefan Fritsch
Gerben, can you please also provide the output of the four commands getent hosts ::1 getent hosts 127.0.0.1 getent hosts localhost getent hosts ip6-localhost both before and after wireless network is configured? Thanks. -- connection forbidden on localhost after wireless connected

[Bug 629633] Re: suexec should be configured to use /home as its docroot

2010-09-03 Thread Stefan Fritsch
Using /home as suexec docroot is a big no-no from a security point of view. It will create local privilege escalation vulnerabilities in many situations. If you don't want to use /var/www you should probably use directories under /srv. In any case, the above howto is outdated. Nowadays there is

[Bug 629633] Re: suexec should be configured to use /home as its docroot

2010-09-03 Thread Stefan Fritsch
Using /home as suexec docroot is a big no-no from a security point of view. It will create local privilege escalation vulnerabilities in many situations. If you don't want to use /var/www you should probably use directories under /srv. In any case, the above howto is outdated. Nowadays there is

[Bug 626728] Re: typing error in default-ssl

2010-09-03 Thread Stefan Fritsch
** Changed in: apache2 (Ubuntu) Status: Triaged = Invalid -- typing error in default-ssl https://bugs.launchpad.net/bugs/626728 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list

[Bug 626728] Re: typing error in default-ssl

2010-08-30 Thread Stefan Fritsch
This is intentional, the regexp is supposed to match MSIE 10 and up. The probability that someone still uses MSIE 1 is zero, but MSIE 10 is not that far away. -- typing error in default-ssl https://bugs.launchpad.net/bugs/626728 You received this bug notification because you are a member of

[Bug 626728] Re: typing error in default-ssl

2010-08-30 Thread Stefan Fritsch
This is intentional, the regexp is supposed to match MSIE 10 and up. The probability that someone still uses MSIE 1 is zero, but MSIE 10 is not that far away. -- typing error in default-ssl https://bugs.launchpad.net/bugs/626728 You received this bug notification because you are a member of

[Bug 582963] Re: SSL pass phrase dialog can't read input

2010-08-02 Thread Stefan Fritsch
apache2's init script has the X-Interactive: true header. IMHO upstart should support this header like insserv does. -- SSL pass phrase dialog can't read input https://bugs.launchpad.net/bugs/582963 You received this bug notification because you are a member of Ubuntu Server Team, which is

[Bug 270899] Re: /etc/init.d/apache2 restart fails on busy webservers

2010-08-02 Thread Stefan Fritsch
A possible culprit is mod_php. Andreas, do you use mod_php and if yes, which php extensions have you loaded? -- /etc/init.d/apache2 restart fails on busy webservers https://bugs.launchpad.net/bugs/270899 You received this bug notification because you are a member of Ubuntu Server Team, which is

[Bug 582963] Re: SSL pass phrase dialog can't read input

2010-08-02 Thread Stefan Fritsch
apache2's init script has the X-Interactive: true header. IMHO upstart should support this header like insserv does. -- SSL pass phrase dialog can't read input https://bugs.launchpad.net/bugs/582963 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed

[Bug 270899] Re: /etc/init.d/apache2 restart fails on busy webservers

2010-08-02 Thread Stefan Fritsch
A possible culprit is mod_php. Andreas, do you use mod_php and if yes, which php extensions have you loaded? -- /etc/init.d/apache2 restart fails on busy webservers https://bugs.launchpad.net/bugs/270899 You received this bug notification because you are a member of Ubuntu Bugs, which is

[Bug 231706] Re: Enable ExtendedStatus for mod_status by default (was: munin apache plugin no data)

2010-07-31 Thread Stefan Fritsch
This has been done in 2.2.15-4 -- Enable ExtendedStatus for mod_status by default (was: munin apache plugin no data) https://bugs.launchpad.net/bugs/231706 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to apache2 in ubuntu. --

[Bug 231706] Re: Enable ExtendedStatus for mod_status by default (was: munin apache plugin no data)

2010-07-31 Thread Stefan Fritsch
This has been done in 2.2.15-4 -- Enable ExtendedStatus for mod_status by default (was: munin apache plugin no data) https://bugs.launchpad.net/bugs/231706 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list

[Bug 609290] Re: Critical bug in memcpy-ssse3-rep.S

2010-07-24 Thread Stefan Fritsch
This is https://issues.apache.org/bugzilla/show_bug.cgi?id=45444 Patch is at http://svn.apache.org/viewvc?rev=683280view=rev ** Bug watch added: Apache Software Foundation Bugzilla #45444 http://issues.apache.org/bugzilla/show_bug.cgi?id=45444 ** Package changed: eglibc (Ubuntu) = apache2

[Bug 589611] Re: client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23)

2010-07-24 Thread Stefan Fritsch
I think Jiří found the source of the problem, but it is a mod_ssl bug after all. Reassigning to apache2. This would be https://issues.apache.org/bugzilla/show_bug.cgi?id=45444 ** Bug watch added: Apache Software Foundation Bugzilla #45444

[Bug 609290] Re: Critical bug in memcpy-ssse3-rep.S

2010-07-24 Thread Stefan Fritsch
Thanks for digging into this, but I thing your analysis is wrong. From man 3posix memcpy: The memcpy() function shall copy n bytes from the object pointed to by s2 into the object pointed to by s1. If copying takes place between objects that overlap, the behavior is undefined. mod_ssl

[Bug 609290] Re: Critical bug in memcpy-ssse3-rep.S

2010-07-24 Thread Stefan Fritsch
This is https://issues.apache.org/bugzilla/show_bug.cgi?id=45444 Patch is at http://svn.apache.org/viewvc?rev=683280view=rev ** Bug watch added: Apache Software Foundation Bugzilla #45444 http://issues.apache.org/bugzilla/show_bug.cgi?id=45444 ** Package changed: eglibc (Ubuntu) = apache2

[Bug 589611] Re: client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23)

2010-07-24 Thread Stefan Fritsch
I think Jiří found the source of the problem, but it is a mod_ssl bug after all. Reassigning to apache2. This would be https://issues.apache.org/bugzilla/show_bug.cgi?id=45444 ** Bug watch added: Apache Software Foundation Bugzilla #45444

[Bug 603211] Re: Apache fails to start after reboot due to missing /var/run/apache2 direcotry when ssl is enabled

2010-07-08 Thread Stefan Fritsch
This should be fixed since 2.2.4-2. Which version are you using? -- Apache fails to start after reboot due to missing /var/run/apache2 direcotry when ssl is enabled https://bugs.launchpad.net/bugs/603211 You received this bug notification because you are a member of Ubuntu Server Team, which

[Bug 603211] Re: Apache fails to start after reboot due to missing /var/run/apache2 direcotry when ssl is enabled

2010-07-08 Thread Stefan Fritsch
That's strange. /usr/sbin/apache2ctl should contain mkdir -p /var/run/apache2 and the init script should only call apache2ctl. Can you check that? And if apache2 failed to start after a boot, you should be able to restart it (using the init script or apache2ctl) without creating the directory.

[Bug 603211] Re: Apache fails to start after reboot due to missing /var/run/apache2 direcotry when ssl is enabled

2010-07-08 Thread Stefan Fritsch
This should be fixed since 2.2.4-2. Which version are you using? -- Apache fails to start after reboot due to missing /var/run/apache2 direcotry when ssl is enabled https://bugs.launchpad.net/bugs/603211 You received this bug notification because you are a member of Ubuntu Bugs, which is

[Bug 603211] Re: Apache fails to start after reboot due to missing /var/run/apache2 direcotry when ssl is enabled

2010-07-08 Thread Stefan Fritsch
That's strange. /usr/sbin/apache2ctl should contain mkdir -p /var/run/apache2 and the init script should only call apache2ctl. Can you check that? And if apache2 failed to start after a boot, you should be able to restart it (using the init script or apache2ctl) without creating the directory.

[Bug 601501] Re: Apache should tap into the shared-mime-info database

2010-07-07 Thread Stefan Fritsch
About magic: Apache's mod_mime_magic does not support all features that are used in /usr/share/mime/magic. Using that file would result in error messages. And from a quick glance at libmagic, it doesn't seem possible to use it in mod_mime_magic either because it is not thread safe. Therefore

[Bug 601501] Re: Apache should tap into the shared-mime-info database

2010-07-07 Thread Stefan Fritsch
About magic: Apache's mod_mime_magic does not support all features that are used in /usr/share/mime/magic. Using that file would result in error messages. And from a quick glance at libmagic, it doesn't seem possible to use it in mod_mime_magic either because it is not thread safe. Therefore

[Bug 589611] Re: client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23)

2010-06-27 Thread Stefan Fritsch
This is a rather strange bug: - It happens if I enable exactly two out of the three modules deflate, reqtimeout, dump_io. But not with only one or all three of them. - I have also tried replacing mod_ssl.so, mod_deflate.so, and the openssl-libs with the versions from karmic and mod_ssl.so with

[Bug 589611] Re: client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23)

2010-06-27 Thread Stefan Fritsch
Actually, I have reproduced bug #595116 and not this one, but I still think it's the same. -- client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23) https://bugs.launchpad.net/bugs/589611 You received this bug notification because you are a member of Ubuntu Server Team, which

[Bug 589611] Re: client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23)

2010-06-27 Thread Stefan Fritsch
This is a rather strange bug: - It happens if I enable exactly two out of the three modules deflate, reqtimeout, dump_io. But not with only one or all three of them. - I have also tried replacing mod_ssl.so, mod_deflate.so, and the openssl-libs with the versions from karmic and mod_ssl.so with

[Bug 589611] Re: client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23)

2010-06-27 Thread Stefan Fritsch
Actually, I have reproduced bug #595116 and not this one, but I still think it's the same. -- client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23) https://bugs.launchpad.net/bugs/589611 You received this bug notification because you are a member of Ubuntu Bugs, which is

[Bug 595116] Re: ssl error reading the headers

2010-06-27 Thread Stefan Fritsch
Robert, please try if deinstalling libc6-i686 or moving /lib/i686 away helps. If yes, please post your /proc/cpuinfo. See my comment in bug #589611 for an explanation. -- ssl error reading the headers https://bugs.launchpad.net/bugs/595116 You received this bug notification because you are a

[Bug 589611] Re: client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23)

2010-06-26 Thread Stefan Fritsch
I suspect this is the same issue as bug #595855 and #595116: Headers are getting truncated with https. So far, I have no idea about the reason. If you have mod_reqtimeout and/or mod_deflate enabled, you can try if disabling one or both of them makes any difference. -- client sent HTTP/1.1

[Bug 589611] Re: client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23)

2010-06-26 Thread Stefan Fritsch
I suspect this is the same issue as bug #595855 and #595116: Headers are getting truncated with https. So far, I have no idea about the reason. If you have mod_reqtimeout and/or mod_deflate enabled, you can try if disabling one or both of them makes any difference. -- client sent HTTP/1.1

[Bug 392759] Re: [FFE] apache2 DoS attack using slowloris

2010-04-08 Thread Stefan Fritsch
You have written enable it by default in the changelog, but AFAICS, you have missed the postinst change that actually enables the module. You may want to merge the NEWS.Debian entry, too. -- [FFE] apache2 DoS attack using slowloris https://bugs.launchpad.net/bugs/392759 You received this bug

  1   2   >