Results for ''

ATOM Icon

625 entries

Let’s encrypt 설치 및 운용(CentOS)
by
[Tomcat] Webapps 보안 설정(접속 차단 및 허용)
by
Apache Security 2.2.x
by
Apache Security 2.0.x
by
Apache Security 1.3.x
by
Tomcat 사용 시 Access Log 기록 방법
by
CentOS5.2에 Proftpd 설치하고 xinetd 방식으로 사용하기
by
보안서버 SSL 구동시 비밀번호 자동 입력 및 부팅시 자동 시작
by
bridge-firewall
by
FTPPUT
by
리눅스 스트리밍
by
리눅스 여러문서에서 문자열 검색 및 변환 팁 정리
by
쉘에서 문자열 길이 구하기
by
Apache RedirectMatch 설정
by
Tomcat heap 사이즈 조절 및 메모리 튜닝
by
server.xml 파일 한글 번역
by
CentOS 5 최소 설치후 해야할것들
by
방화벽 스크립트
by
현재의 mysql 패스워드를 모를때 변경할수 있는 shell
by
mysql-5.0.18 버전에서 사용자 추가 스크립트.
by
◀ 이전페이지 1 2 3 4 5 ... 32

Let’s encrypt 설치 및 운용(CentOS)

Secure 2016/12/07 16:07
Mozila 재단에서 진행하는 무료SSL(90일) 인증서 발급 프로젝트 이다. ( https://letsencrypt.org )
CentOS 6.x 와 APM 서버 환경에서 진행.


1. 설치 ( ISU 레포지트리 배포처 https://ius.io/GettingStarted )
cd /usr/local
yum install epel-release
rpm -ivh https://rhel6.iuscommunity.org/ius-release.rpm
yum install git python27 python27-devel python27-pip python27-setuptools python27-virtualenv python27-libs
git clone https://github.com/letsencrypt/letsencrypt

설치는 그냥 필수 라이브러리를 설치하고 git을 통해 실행 스크립트를 가져오는 수준이다.

2. 실행(일반 사용법)

/usr/local/letsencrypt/letsencrypt-auto certonly
cd /usr/local/letsencrypt


3. 단축 명령어(인증서 발급)
cd /usr/local/letsencrypt


cd /usr/local/letsencrypt
/letsencrypt-auto certonly --server https://acme-v01.api.letsencrypt.org/directory \
                       --rsa-key-size 4096 --agree-tos --email sample@gmail.com \
                       --webroot -w /home/www.sample.com/public_html/ \
                       -d www.sample.com

--email --webroot -d : 이메일, 경로, 도메인 수정

4. 아파치 설정.
SSLProtocol            ALL -SSLv2 -SSLv3
SSLCipherSuite         ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
SSLHonorCipherOrder    on
 
Listen 443
<VirtualHost *:443>
DocumentRoot /free/home/enteroa/html
ServerName wp.enteroa.kr
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/wp.enteroa.kr/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/wp.enteroa.kr/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/wp.enteroa.kr/chain.pem
SSLCACertificateFile /etc/letsencrypt/live/wp.enteroa.kr/fullchain.pem
Header always set Strict-Transport-Security "max-age=15552000"
</VirtualHost>


5. 갱신
letsencrypt_renew.sh

#!/bin/bash

# 실행 조건 1일 1회 작동
## pid 생성 중복실행을 방지 #######################################################
if [[ -s $0.pid ]];then exist_pid=`cat $0.pid`
  if [[ -z `ps -e|grep $exist_pid` ]];then rm -f $0.pid;exec_confirm="Y"
  else exec_confirm="N";echo -e "\e[1;32mShell has already running...\e[0m";fi
else exec_confirm="Y";fi
if [[ $exec_confirm == "Y" ]];then
  echo $$ > $0.pid
###################################################################################
 
  cd /usr/local/letsencrypt
  chattr -i /usr/bin/gcc /usr/bin/g++
  /usr/local/letsencrypt/letsencrypt-auto renew --rsa-key-size 4096
  chmod 700 /usr/bin/gcc /usr/bin/g++;chattr +i /usr/bin/gcc /usr/bin/g++
  find /tmp -maxdepth 1 -type d -perm 700 -user root -name 'tmp.*' -exec rm -rf {} \;
 
###################################################################################
  rm -f $0.pid
fi
###################################################################################



6. 이용 제한( rate limit )
아무래도 무료SSL의 무분별한 사용을 막기 위한 설정이라고 보면 되겠다.
 - 1개의 IP 에서 3시간동안 10개의 도메인을 허용

 - 7일 동안 1개의 도메인에서 5개의 도메인레코드 선언을 허용
이 rate limit 는 발급받은 SSL 을 revoke(취소) 하거나 /etc/letsencrypt/ 에 생성된 항목을 삭제하더라도 반환되지 않습니다.


7. 인증서에 도메인 추가


cd /usr/local/letsencrypt
./letsencrypt-auto certonly --server https://acme-v01.api.letsencrypt.org/directory \
                       --rsa-key-size 4096 -agree-dev-preview --agree-tos \
                       --webroot -w /free/home/enteroa/html/ --email enteroa.j@gmail.com \
                       -d wp.enteroa.kr -d enteroa.kr -d www.enteroa.kr

위 명령어로 진행시 기존 인증서에 도메인을 추가(EXPAND)할껀지 물어보는데 enter를 눌러서 진행하면 된다.
2016/12/07 16:07 2016/12/07 16:07
트랙백 0개, 댓글 0개가 달렸습니다.

[Tomcat] Webapps 보안 설정(접속 차단 및 허용)

Web Server/Tomcat 2012/03/15 11:09

Tomcat 웹서버 설정 중에 필터링에 관한 정보입니다.

TOMCAT_HOME/conf/server.xml을 열으셔서 다음과 같이 추가하시면 됩니다.

...생략

<Host name="localhost" appBase="webapps"
unpackWARs="true" autoDeploy="true"
xmlValidation="false" xmlNamespaceAware="false">

<!-- 전체 webapps 특정 아이피 접근 허용하는 방법 -->

<Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="127.0.0.1" />

<!-- webapps 안 폴더 하나에 대해 특정 아이피 접근 허용하는 방법 -->
<Context path="/폴더이름"> <!-- 톰캣 폴더 안에 webapps 폴더 안 -->
<Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="127.0.0.1" />
</Context>

</Host>

....생략...

deny는 들어오는 아이피 중에 특정 아이피를 차단하는 것이고 allow는 해당 아이피만 들어올수 있도록 설정을 하는것입니다.

deny와 allow 부분에 아이피 말고 도메인으로도 설정을 해줄 수가 있고 여러개의 아이피를 넣을때는 구분자 , 로 다중으로 등록을 하실 수 있습니다.

1. 차단하는 경우

<Valve className="org.apache.catalina.valves.RemoteAddrValve" deny="127.0.0.*" />

2. 허용하는 경우

<Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="192.168.0.*" />

참고 : http://tomcat.apache.org/tomcat-5.5-doc/config/valve.html

출처 : http://www.devwing.net/blog?PostNo=43

2012/03/15 11:09 2012/03/15 11:09
트랙백 0개, 댓글 0개가 달렸습니다.

Apache Security 2.2.x

Web Server/Apache 2010/08/09 13:52
Apache httpd 2.2 vulnerabilities

This page lists all security vulnerabilities fixed in released versions of Apache httpd 2.2. Each vulnerability is given a security impact rating by the Apache security team - please note that this rating may well vary from platform to platform. We also list the versions of Apache httpd the flaw is known to affect, and where a flaw has not been verified list the version with a question mark.

Please note that if a vulnerability is shown below as being fixed in a "-dev" release then this means that a fix has been applied to the development source tree and will be part of an upcoming full release.

This page is created from a database of vulnerabilities originally populated by Apache Week. Please send comments or corrections for these vulnerabilities to the Security Team.

Fixed in Apache httpd 2.2.16
important: Timeout detection flaw (mod_proxy_http) CVE-2010-2068

An information disclosure flaw was found in mod_proxy_http in versions 2.2.9 through 2.2.15, 2.3.4-alpha and 2.3.5-alpha. Under certain timeout conditions, the server could return a response intended for another user. Only Windows, Netware and OS2 operating systems are affected. Only those configurations which trigger the use of proxy worker pools are affected. There was no vulnerability on earlier versions, as proxy pools were not yet introduced. The simplest workaround is to globally configure;

SetEnv proxy-nokeepalive 1

Source code patches are at;

Binary replacement modules are at

Acknowledgements: We would like to thank Loren Anderson for the detailed analysis and reporting of this issue.

Update Released: 25th July 2010
Affects: 2.3.5-alpha, 2.3.4-alpha, 2.2.15, 2.2.14, 2.2.13, 2.2.12, 2.2.11, 2.2.10, 2.2.9
low: mod_cache and mod_dav DoS CVE-2010-1452

A flaw was found in the handling of requests by mod_cache and mod_dav. A malicious remote attacker could send a carefully crafted request and cause a httpd child process to crash. This crash would only be a denial of service if using the worker MPM. This issue is further mitigated as mod_dav is only affected by requests that are most likely to be authenticated, and mod_cache is only affected if the uncommon "CacheIgnoreURLSessionIdentifiers" directive, introduced in version 2.2.14, is used.

Acknowledgements: This issue was reported by Mark Drayton.

Update Released: 25th July 2010
Affects: 2.2.15, 2.2.14, 2.2.13, 2.2.12, 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
Fixed in Apache httpd 2.2.15
important: mod_isapi module unload flaw CVE-2010-0425

A flaw was found with within mod_isapi which would attempt to unload the ISAPI dll when it encountered various error states. This could leave the callbacks in an undefined state and result in a segfault. On Windows platforms using mod_isapi, a remote attacker could send a malicious request to trigger this issue, and as win32 MPM runs only one process, this would result in a denial of service, and potentially allow arbitrary code execution.

Acknowledgements: We would like to thank Brett Gervasoni of Sense of Security for reporting and proposing a patch fix for this issue.

Update Released: 5th March 2010
Affects: 2.2.14, 2.2.13, 2.2.12, 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
low: Subrequest handling of request headers (mod_headers) CVE-2010-0434

A flaw in the core subrequest process code was fixed, to always provide a shallow copy of the headers_in array to the subrequest, instead of a pointer to the parent request's array as it had for requests without request bodies. This meant all modules such as mod_headers which may manipulate the input headers for a subrequest would poison the parent request in two ways, one by modifying the parent request, which might not be intended, and second by leaving pointers to modified header fields in memory allocated to the subrequest scope, which could be freed before the main request processing was finished, resulting in a segfault or in revealing data from another request on threaded servers, such as the worker or winnt MPMs.

Acknowledgements: We would like to thank Philip Pickett of VMware for reporting and proposing a fix for this issue.

Update Released: 5th March 2010
Affects: 2.2.14, 2.2.13, 2.2.12, 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
moderate: mod_proxy_ajp DoS CVE-2010-0408

mod_proxy_ajp would return the wrong status code if it encountered an error, causing a backend server to be put into an error state until the retry timeout expired. A remote attacker could send malicious requests to trigger this issue, resulting in denial of service.

Acknowledgements: We would like to thank Niku Toivola of Sulake Corporation for reporting and proposing a patch fix for this issue.

Update Released: 5th March 2010
Affects: 2.2.14, 2.2.13, 2.2.12, 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
Fixed in Apache httpd 2.2.14
low: mod_proxy_ftp DoS CVE-2009-3094

A NULL pointer dereference flaw was found in the mod_proxy_ftp module. A malicious FTP server to which requests are being proxied could use this flaw to crash an httpd child process via a malformed reply to the EPSV or PASV commands, resulting in a limited denial of service.

Update Released: 5th October 2009
Affects: 2.2.13, 2.2.12, 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
low: mod_proxy_ftp FTP command injection CVE-2009-3095

A flaw was found in the mod_proxy_ftp module. In a reverse proxy configuration, a remote attacker could use this flaw to bypass intended access restrictions by creating a carefully-crafted HTTP Authorization header, allowing the attacker to send arbitrary commands to the FTP server.

Update Released: 5th October 2009
Affects: 2.2.13, 2.2.12, 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
moderate: Solaris pollset DoS CVE-2009-2699

Faulty error handling was found affecting Solaris pollset support (Event Port backend) caused by a bug in APR. A remote attacker could trigger this issue on Solaris servers which used prefork or event MPMs, resulting in a denial of service.

Update Released: 5th October 2009
Affects: 2.2.13, 2.2.12, 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
Fixed in Apache httpd 2.2.13
low: APR apr_palloc heap overflow CVE-2009-2412

A flaw in apr_palloc() in the bundled copy of APR could cause heap overflows in programs that try to apr_palloc() a user controlled size. The Apache HTTP Server itself does not pass unsanitized user-provided sizes to this function, so it could only be triggered through some other application which uses apr_palloc() in a vulnerable way.

Update Released: 9th August 2009
Affects: 2.2.12, 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
Fixed in Apache httpd 2.2.12
important: mod_proxy reverse proxy DoS CVE-2009-1890

A denial of service flaw was found in the mod_proxy module when it was used as a reverse proxy. A remote attacker could use this flaw to force a proxy process to consume large amounts of CPU time.

Update Released: 27th July 2009
Affects: 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
important: mod_proxy_ajp information disclosure CVE-2009-1191

An information disclosure flaw was found in mod_proxy_ajp in version 2.2.11 only. In certain situations, if a user sent a carefully crafted HTTP request, the server could return a response intended for another user.

Update Released: 27th July 2009
Affects: 2.2.11
low: mod_deflate DoS CVE-2009-1891

A denial of service flaw was found in the mod_deflate module. This module continued to compress large files until compression was complete, even if the network connection that requested the content was closed before compression completed. This would cause mod_deflate to consume large amounts of CPU if mod_deflate was enabled for a large file.

Update Released: 27th July 2009
Affects: 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
low: AllowOverride Options handling bypass CVE-2009-1195

A flaw was found in the handling of the "Options" and "AllowOverride" directives. In configurations using the "AllowOverride" directive with certain "Options=" arguments, local users were not restricted from executing commands from a Server-Side-Include script as intended.

Update Released: 27th July 2009
Affects: 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
moderate: APR-util off-by-one overflow CVE-2009-1956

An off-by-one overflow flaw was found in the way the bundled copy of the APR-util library processed a variable list of arguments. An attacker could provide a specially-crafted string as input for the formatted output conversion routine, which could, on big-endian platforms, potentially lead to the disclosure of sensitive information or a denial of service.

Update Released: 72th  2009
Affects: 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
moderate: APR-util XML DoS CVE-2009-1955

A denial of service flaw was found in the bundled copy of the APR-util library Extensible Markup Language (XML) parser. A remote attacker could create a specially-crafted XML document that would cause excessive memory consumption when processed by the XML decoding engine.

Update Released: 27th July 2009
Affects: 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
moderate: APR-util heap underwrite CVE-2009-0023

A heap-based underwrite flaw was found in the way the bundled copy of the APR-util library created compiled forms of particular search patterns. An attacker could formulate a specially-crafted search keyword, that would overwrite arbitrary heap memory locations when processed by the pattern preparation engine.

Update Released: 27th July 2009
Affects: 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
Fixed in Apache httpd 2.2.10
important: Timeout detection flaw (mod_proxy_http) CVE-2010-2791

An information disclosure flaw was found in mod_proxy_http in version 2.2.9 only, on Unix platforms. Under certain timeout conditions, the server could return a response intended for another user. Only those configurations which trigger the use of proxy worker pools are affected. There was no vulnerability on earlier versions, as proxy pools were not yet introduced. The simplest workaround is to globally configure:

SetEnv proxy-nokeepalive 1

Update Released: 31st October 2008
Affects: 2.2.9
low: mod_proxy_ftp globbing XSS CVE-2008-2939

A flaw was found in the handling of wildcards in the path of a FTP URL with mod_proxy_ftp. If mod_proxy_ftp is enabled to support FTP-over-HTTP, requests containing globbing characters could lead to cross-site scripting (XSS) attacks.

Update Released: 31st October 2008
Affects: 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
Fixed in Apache httpd 2.2.9
low: mod_proxy_balancer CSRF CVE-2007-6420

The mod_proxy_balancer provided an administrative interface that could be vulnerable to cross-site request forgery (CSRF) attacks.

Update Released: 14th June 2008
Affects: 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
moderate: mod_proxy_http DoS CVE-2008-2364

A flaw was found in the handling of excessive interim responses from an origin server when using mod_proxy_http. A remote attacker could cause a denial of service or high memory usage.

Update Released: 14th June 2008
Affects: 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
Fixed in Apache httpd 2.2.8
low: mod_proxy_ftp UTF-7 XSS CVE-2008-0005

A workaround was added in the mod_proxy_ftp module. On sites where mod_proxy_ftp is enabled and a forward proxy is configured, a cross-site scripting attack is possible against Web browsers which do not correctly derive the response character set following the rules in RFC 2616.

Update Released: 19th January 2008
Affects: 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
low: mod_proxy_balancer DoS CVE-2007-6422

A flaw was found in the mod_proxy_balancer module. On sites where mod_proxy_balancer is enabled, an authorized user could send a carefully crafted request that would cause the Apache child process handling that request to crash. This could lead to a denial of service if using a threaded Multi-Processing Module.

Update Released: 19th January 2008
Affects: 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
low: mod_proxy_balancer XSS CVE-2007-6421

A flaw was found in the mod_proxy_balancer module. On sites where mod_proxy_balancer is enabled, a cross-site scripting attack against an authorized user is possible.

Update Released: 19th January 2008
Affects: 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
moderate: mod_status XSS CVE-2007-6388

A flaw was found in the mod_status module. On sites where mod_status is enabled and the status pages were publicly accessible, a cross-site scripting attack is possible. Note that the server-status page is not enabled by default and it is best practice to not make this publicly available.

Update Released: 19th January 2008
Affects: 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
moderate: mod_imagemap XSS CVE-2007-5000

A flaw was found in the mod_imagemap module. On sites where mod_imagemap is enabled and an imagemap file is publicly available, a cross-site scripting attack is possible.

Update Released: 19th January 2008
Affects: 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0
Fixed in Apache httpd 2.2.6
moderate: mod_proxy crash CVE-2007-3847

A flaw was found in the Apache HTTP Server mod_proxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a forward proxy is configured, an attacker could cause a similar crash if a user could be persuaded to visit a malicious site using the proxy. This could lead to a denial of service if using a threaded Multi-Processing Module.

Update Released: 7th September 2007
Affects: 2.2.4, 2.2.3, 2.2.2, 2.2.0
moderate: mod_status cross-site scripting CVE-2006-5752

A flaw was found in the mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. Note that the server-status page is not enabled by default and it is best practice to not make this publicly available.

Update Released: 7th September 2007
Affects: 2.2.4, 2.2.3, 2.2.2, 2.2.0
moderate: Signals to arbitrary processes CVE-2007-3304

The Apache HTTP server did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the HTTP server could manipulate the scoreboard and cause arbitrary processes to be terminated which could lead to a denial of service.

Update Released: 7th September 2007
Affects: 2.2.4, 2.2.3, 2.2.2, 2.2.0
moderate: mod_cache information leak CVE-2007-1862

The recall_headers function in mod_mem_cache in Apache 2.2.4 did not properly copy all levels of header data, which can cause Apache to return HTTP headers containing previously used data, which could be used by remote attackers to obtain potentially sensitive information.

Update Released: 7th September 2007
Affects: 2.2.4
moderate: mod_cache proxy DoS CVE-2007-1863

A bug was found in the mod_cache module. On sites where caching is enabled, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. This could lead to a denial of service if using a threaded Multi-Processing Module.

Update Released: 7th September 2007
Affects: 2.2.4, 2.2.3, 2.2.2, 2.2.0
Fixed in Apache httpd 2.2.3
important: mod_rewrite off-by-one error CVE-2006-3747

An off-by-one flaw exists in the Rewrite module, mod_rewrite. Depending on the manner in which Apache httpd was compiled, this software defect may result in a vulnerability which, in combination with certain types of Rewrite rules in the web server configuration files, could be triggered remotely. For vulnerable builds, the nature of the vulnerability can be denial of service (crashing of web server processes) or potentially allow arbitrary code execution.

Update Released: 27th July 2006
Affects: 2.2.2, 2.2.0
Fixed in Apache httpd 2.2.2
low: mod_ssl access control DoS CVE-2005-3357

A NULL pointer dereference flaw in mod_ssl was discovered affecting server configurations where an SSL virtual host is configured with access control and a custom 400 error document. A remote attacker could send a carefully crafted request to trigger this issue which would lead to a crash. This crash would only be a denial of service if using the worker MPM.

Update Released: 1st May 2006
Affects: 2.2.0
moderate: mod_imap Referer Cross-Site Scripting CVE-2005-3352

A flaw in mod_imap when using the Referer directive with image maps. In certain site configurations a remote attacker could perform a cross-site scripting attack if a victim can be forced to visit a malicious URL using certain web browsers.

Update Released: 1st May 2006
Affects: 2.2.0
2010/08/09 13:52 2010/08/09 13:52
트랙백 0개, 댓글 0개가 달렸습니다.

Apache Security 2.0.x

Web Server/Apache 2010/08/09 13:51
Apache httpd 2.0 vulnerabilities

This page lists all security vulnerabilities fixed in released versions of Apache httpd 2.0. Each vulnerability is given a security impact rating by the Apache security team - please note that this rating may well vary from platform to platform. We also list the versions of Apache httpd the flaw is known to affect, and where a flaw has not been verified list the version with a question mark.

Please note that if a vulnerability is shown below as being fixed in a "-dev" release then this means that a fix has been applied to the development source tree and will be part of an upcoming full release.

This page is created from a database of vulnerabilities originally populated by Apache Week. Please send comments or corrections for these vulnerabilities to the Security Team.

Fixed in Apache httpd 2.0.64-dev
important: mod_isapi module unload flaw CVE-2010-0425

A flaw was found with within mod_isapi which would attempt to unload the ISAPI dll when it encountered various error states. This could leave the callbacks in an undefined state and result in a segfault. On Windows platforms using mod_isapi, a remote attacker could send a malicious request to trigger this issue, and as win32 MPM runs only one process, this would result in a denial of service, and potentially allow arbitrary code execution.

Acknowledgements: We would like to thank Brett Gervasoni of Sense of Security for reporting and proposing a patch fix for this issue.

Affects: 2.0.63, 2.0.61, 2.0.59, 2.0.58, 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37
low: mod_proxy_ftp FTP command injection CVE-2009-3095

A flaw was found in the mod_proxy_ftp module. In a reverse proxy configuration, a remote attacker could use this flaw to bypass intended access restrictions by creating a carefully-crafted HTTP Authorization header, allowing the attacker to send arbitrary commands to the FTP server.

Affects: 2.0.63, 2.0.61, 2.0.59, 2.0.58, 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
low: mod_proxy_ftp DoS CVE-2009-3094

A NULL pointer dereference flaw was found in the mod_proxy_ftp module. A malicious FTP server to which requests are being proxied could use this flaw to crash an httpd child process via a malformed reply to the EPSV or PASV commands, resulting in a limited denial of service.

Affects: 2.0.63, 2.0.61, 2.0.59, 2.0.58, 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
low: Subrequest handling of request headers (mod_headers) CVE-2010-0434

A flaw in the core subrequest process code was fixed, to always provide a shallow copy of the headers_in array to the subrequest, instead of a pointer to the parent request's array as it had for requests without request bodies. This meant all modules such as mod_headers which may manipulate the input headers for a subrequest would poison the parent request in two ways, one by modifying the parent request, which might not be intended, and second by leaving pointers to modified header fields in memory allocated to the subrequest scope, which could be freed before the main request processing was finished, resulting in a segfault or in revealing data from another request on threaded servers, such as the worker or winnt MPMs.

Acknowledgements: We would like to thank Philip Pickett of VMware for reporting and proposing a fix for this issue.

Affects: 2.0.63, 2.0.61, 2.0.59, 2.0.58, 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
low: mod_proxy_ftp globbing XSS CVE-2008-2939

A flaw was found in the handling of wildcards in the path of a FTP URL with mod_proxy_ftp. If mod_proxy_ftp is enabled to support FTP-over-HTTP, requests containing globbing characters could lead to cross-site scripting (XSS) attacks.

Affects: 2.0.63, 2.0.61, 2.0.59, 2.0.58, 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
moderate: mod_proxy_http DoS CVE-2008-2364

A flaw was found in the handling of excessive interim responses from an origin server when using mod_proxy_http. A remote attacker could cause a denial of service or high memory usage.

Affects: 2.0.63, 2.0.61, 2.0.59, 2.0.58, 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
Fixed in Apache httpd 2.0.63
low: mod_proxy_ftp UTF-7 XSS CVE-2008-0005

A workaround was added in the mod_proxy_ftp module. On sites where mod_proxy_ftp is enabled and a forward proxy is configured, a cross-site scripting attack is possible against Web browsers which do not correctly derive the response character set following the rules in RFC 2616.

Update Released: 19th January 2008
Affects: 2.0.61, 2.0.59, 2.0.58, 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
moderate: mod_status XSS CVE-2007-6388

A flaw was found in the mod_status module. On sites where mod_status is enabled and the status pages were publicly accessible, a cross-site scripting attack is possible. Note that the server-status page is not enabled by default and it is best practice to not make this publicly available.

Update Released: 19th January 2008
Affects: 2.0.61, 2.0.59, 2.0.58, 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
moderate: mod_imap XSS CVE-2007-5000

A flaw was found in the mod_imap module. On sites where mod_imap is enabled and an imagemap file is publicly available, a cross-site scripting attack is possible.

Update Released: 19th January 2008
Affects: 2.0.61, 2.0.59, 2.0.58, 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
Fixed in Apache httpd 2.0.61
moderate: mod_proxy crash CVE-2007-3847

A flaw was found in the Apache HTTP Server mod_proxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a forward proxy is configured, an attacker could cause a similar crash if a user could be persuaded to visit a malicious site using the proxy. This could lead to a denial of service if using a threaded Multi-Processing Module.

Update Released: 7th September 2007
Affects: 2.0.59, 2.0.58, 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
moderate: mod_status cross-site scripting CVE-2006-5752

A flaw was found in the mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. Note that the server-status page is not enabled by default and it is best practice to not make this publicly available.

Update Released: 7th September 2007
Affects: 2.0.59, 2.0.58, 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
moderate: Signals to arbitrary processes CVE-2007-3304

The Apache HTTP server did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the HTTP server could manipulate the scoreboard and cause arbitrary processes to be terminated which could lead to a denial of service.

Update Released: 7th September 2007
Affects: 2.0.59, 2.0.58, 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
moderate: mod_cache proxy DoS CVE-2007-1863

A bug was found in the mod_cache module. On sites where caching is enabled, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. This could lead to a denial of service if using a threaded Multi-Processing Module.

Update Released: 7th September 2007
Affects: 2.0.59, 2.0.58, 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37
Fixed in Apache httpd 2.0.59
important: mod_rewrite off-by-one error CVE-2006-3747

An off-by-one flaw exists in the Rewrite module, mod_rewrite. Depending on the manner in which Apache httpd was compiled, this software defect may result in a vulnerability which, in combination with certain types of Rewrite rules in the web server configuration files, could be triggered remotely. For vulnerable builds, the nature of the vulnerability can be denial of service (crashing of web server processes) or potentially allow arbitrary code execution.

Update Released: 27th July 2006
Affects: 2.0.58, 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46
Fixed in Apache httpd 2.0.58
low: mod_ssl access control DoS CVE-2005-3357

A NULL pointer dereference flaw in mod_ssl was discovered affecting server configurations where an SSL virtual host is configured with access control and a custom 400 error document. A remote attacker could send a carefully crafted request to trigger this issue which would lead to a crash. This crash would only be a denial of service if using the worker MPM.

Update Released: 1st May 2006
Affects: 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
moderate: mod_imap Referer Cross-Site Scripting CVE-2005-3352

A flaw in mod_imap when using the Referer directive with image maps. In certain site configurations a remote attacker could perform a cross-site scripting attack if a victim can be forced to visit a malicious URL using certain web browsers.

Update Released: 1st May 2006
Affects: 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
Fixed in Apache httpd 2.0.55
important: SSLVerifyClient bypass CVE-2005-2700

A flaw in the mod_ssl handling of the "SSLVerifyClient" directive. This flaw would occur if a virtual host has been configured using "SSLVerifyClient optional" and further a directive "SSLVerifyClient required" is set for a specific location. For servers configured in this fashion, an attacker may be able to access resources that should otherwise be protected, by not supplying a client certificate when connecting.

Update Released: 14th October 2005
Affects: 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
low: Worker MPM memory leak CVE-2005-2970

A memory leak in the worker MPM would allow remote attackers to cause a denial of service (memory consumption) via aborted connections, which prevents the memory for the transaction pool from being reused for other connections. This issue was downgraded in severity to low (from moderate) as sucessful exploitation of the race condition would be difficult.

Update Released: 14th October 2005
Affects: 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36
low: PCRE overflow CVE-2005-2491

An integer overflow flaw was found in PCRE, a Perl-compatible regular expression library included within httpd. A local user who has the ability to create .htaccess files could create a maliciously crafted regular expression in such as way that they could gain the privileges of a httpd child.

Update Released: 14th October 2005
Affects: 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
low: Malicious CRL off-by-one CVE-2005-1268

An off-by-one stack overflow was discovered in the mod_ssl CRL verification callback. In order to exploit this issue the Apache server would need to be configured to use a malicious certificate revocation list (CRL)

Update Released: 14th October 2005
Affects: 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
moderate: Byterange filter DoS CVE-2005-2728

A flaw in the byterange filter would cause some responses to be buffered into memory. If a server has a dynamic resource such as a CGI script or PHP script which generates a large amount of data, an attacker could send carefully crafted requests in order to consume resources, potentially leading to a Denial of Service.

Update Released: 14th October 2005
Affects: 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
moderate: HTTP Request Spoofing CVE-2005-2088

A flaw occured when using the Apache server as a HTTP proxy. A remote attacker could send a HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, causing Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request. This could allow the bypass of web application firewall protection or lead to cross-site scripting (XSS) attacks.

Update Released: 14th October 2005
Affects: 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
Fixed in Apache httpd 2.0.53
important: Memory consumption DoS CVE-2004-0942

An issue was discovered where the field length limit was not enforced for certain malicious requests. This could allow a remote attacker who is able to send large amounts of data to a server the ability to cause Apache children to consume proportional amounts of memory, leading to a denial of service.

Update Released: 8th February 2005
Affects: 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
low: mod_disk_cache stores sensitive headers CVE-2004-1834

The experimental mod_disk_cache module stored client authentication credentials for cached objects such as proxy authentication credentials and Basic Authentication passwords on disk.

Update Released: 8th February 2005
Affects: 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
moderate: SSLCipherSuite bypass CVE-2004-0885

An issue has been discovered in the mod_ssl module when configured to use the "SSLCipherSuite" directive in directory or location context. If a particular location context has been configured to require a specific set of cipher suites, then a client will be able to access that location using any cipher suite allowed by the virtual host configuration.

Update Released: 8th February 2005
Affects: 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
Fixed in Apache httpd 2.0.52
important: Basic authentication bypass CVE-2004-0811

A flaw in Apache 2.0.51 (only) broke the merging of the Satisfy directive which could result in access being granted to resources despite any configured authentication

Update Released: 28th September 2004
Affects: 2.0.51
Fixed in Apache httpd 2.0.51
critical: IPv6 URI parsing heap overflow CVE-2004-0786

Testing using the Codenomicon HTTP Test Tool performed by the Apache Software Foundation security group and Red Hat uncovered an input validation issue in the IPv6 URI parsing routines in the apr-util library. If a remote attacker sent a request including a carefully crafted URI, an httpd child process could be made to crash. One some BSD systems it is believed this flaw may be able to lead to remote code execution.

Update Released: 15th September 2004
Affects: 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
important: SSL connection infinite loop CVE-2004-0748

An issue was discovered in the mod_ssl module in Apache 2.0. A remote attacker who forces an SSL connection to be aborted in a particular state may cause an Apache child process to enter an infinite loop, consuming CPU resources.

Update Released: 15th September 2004
Affects: 2.0.50, 2.0.49?, 2.0.48?, 2.0.47?, 2.0.46?, 2.0.45?, 2.0.44?, 2.0.43?, 2.0.42?, 2.0.40?, 2.0.39?, 2.0.37?, 2.0.36?, 2.0.35?
low: Environment variable expansion flaw CVE-2004-0747

A buffer overflow was found in the expansion of environment variables during configuration file parsing. This issue could allow a local user to gain the privileges of a httpd child if a server can be forced to parse a carefully crafted .htaccess file written by a local user.

Acknowledgements: We would like to thank the Swedish IT Incident Centre (SITIC) for reporting this issue.

Update Released: 15th September 2004
Affects: 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
low: Malicious SSL proxy can cause crash CVE-2004-0751

An issue was discovered in the mod_ssl module in Apache 2.0.44-2.0.50 which could be triggered if the server is configured to allow proxying to a remote SSL server. A malicious remote SSL server could force an httpd child process to crash by sending a carefully crafted response header. This issue is not believed to allow execution of arbitrary code and will only result in a denial of service where a threaded process model is in use.

Update Released: 15th September 2004
Affects: 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44
low: WebDAV remote crash CVE-2004-0809

An issue was discovered in the mod_dav module which could be triggered for a location where WebDAV authoring access has been configured. A malicious remote client which is authorized to use the LOCK method could force an httpd child process to crash by sending a particular sequence of LOCK requests. This issue does not allow execution of arbitrary code. and will only result in a denial of service where a threaded process model is in use.

Update Released: 15th September 2004
Affects: 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
Fixed in Apache httpd 2.0.50
important: Header parsing memory leak CVE-2004-0493

A memory leak in parsing of HTTP headers which can be triggered remotely may allow a denial of service attack due to excessive memory consumption.

Update Released: 1st July 2004
Affects: 2.0.49, 2.0.48?, 2.0.47?, 2.0.46?, 2.0.45?, 2.0.44?, 2.0.43?, 2.0.42?, 2.0.40?, 2.0.39?, 2.0.37?, 2.0.36?, 2.0.35?
low: FakeBasicAuth overflow CVE-2004-0488

A buffer overflow in the mod_ssl FakeBasicAuth code could be exploited by an attacker using a (trusted) client certificate with a subject DN field which exceeds 6K in length.

Update Released: 1st July 2004
Affects: 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
Fixed in Apache httpd 2.0.49
important: listening socket starvation CVE-2004-0174

A starvation issue on listening sockets occurs when a short-lived connection on a rarely-accessed listening socket will cause a child to hold the accept mutex and block out new connections until another connection arrives on that rarely-accessed listening socket. This issue is known to affect some versions of AIX, Solaris, and Tru64; it is known to not affect FreeBSD or Linux.

Update Released: 19th March 2004
Affects: 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
important: mod_ssl memory leak CVE-2004-0113

A memory leak in mod_ssl allows a remote denial of service attack against an SSL-enabled server by sending plain HTTP requests to the SSL port.

Update Released: 19th March 2004
Affects: 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
low: Error log escape filtering CVE-2003-0020

Apache does not filter terminal escape sequences from error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.

Update Released: 19th March 2004
Affects: 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
Fixed in Apache httpd 2.0.48
low: Local configuration regular expression overflow CVE-2003-0542

By using a regular expression with more than 9 captures a buffer overflow can occur in mod_alias or mod_rewrite. To exploit this an attacker would need to be able to create a carefully crafted configuration file (.htaccess or httpd.conf)

Update Released: 27th October 2003
Affects: 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
moderate: CGI output information leak CVE-2003-0789

A bug in mod_cgid mishandling of CGI redirect paths can result in CGI output going to the wrong client when a threaded MPM is used.

Update Released: 27th October 2003
Affects: 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
Fixed in Apache httpd 2.0.47
important: Remote DoS with multiple Listen directives CVE-2003-0253

In a server with multiple listening sockets a certain error returned by accept() on a rarely access port can cause a temporary denial of service, due to a bug in the prefork MPM.

Update Released: 9th July 2003
Affects: 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
low: mod_ssl renegotiation issue CVE-2003-0192

A bug in the optional renegotiation code in mod_ssl included with Apache httpd can cause cipher suite restrictions to be ignored. This is triggered if optional renegotiation is used (SSLOptions +OptRenegotiate) along with verification of client certificates and a change to the cipher suite over the renegotiation.

Update Released: 9th July 2003
Affects: 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
moderate: Remote DoS via IPv6 ftp proxy CVE-2003-0254

When a client requests that proxy ftp connect to a ftp server with IPv6 address, and the proxy is unable to create an IPv6 socket, an infinite loop occurs causing a remote Denial of Service.

Update Released: 9th July 2003
Affects: 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
Fixed in Apache httpd 2.0.46
critical: APR remote crash CVE-2003-0245

A vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors.

Update Released: 28th May 2003
Affects: 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37
important: Basic Authentication DoS CVE-2003-0189

A build system problem in Apache 2.0.40 through 2.0.45 allows remote attackers to cause a denial of access to authenticated content when a threaded server is used.

Update Released: 28th May 2003
Affects: 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40
important: OS2 device name DoS CVE-2003-0134

Apache on OS2 up to and including Apache 2.0.45 have a Denial of Service vulnerability caused by device names.

Update Released: 28th May 2003
Affects: 2.0.45, 2.0.44?, 2.0.43?, 2.0.42?, 2.0.40?, 2.0.39?, 2.0.37?, 2.0.36?, 2.0.35?
low: Filtered escape sequences CVE-2003-0083

Apache did not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.

Update Released: 2nd April 2004
Affects: 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
Fixed in Apache httpd 2.0.45
important: Line feed memory leak DoS CVE-2003-0132

Apache 2.0 versions before Apache 2.0.45 had a significant Denial of Service vulnerability. Remote attackers could cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.

Update Released: 2nd April 2004
Affects: 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
Fixed in Apache httpd 2.0.44
critical: MS-DOS device name filtering CVE-2003-0016

On Windows platforms Apache did not correctly filter MS-DOS device names which could lead to denial of service attacks or remote code execution.

Update Released: 20th January 2003
Affects: 2.0.43, 2.0.42?, 2.0.40?, 2.0.39?, 2.0.37?, 2.0.36?, 2.0.35?
important: Apache can serve unexpected files CVE-2003-0017

On Windows platforms Apache could be forced to serve unexpected files by appending illegal characters such as '<' to the request URL

Update Released: 20th January 2003
Affects: 2.0.43, 2.0.42?, 2.0.40?, 2.0.39?, 2.0.37?, 2.0.36?, 2.0.35?
Fixed in Apache httpd 2.0.43
low: Error page XSS using wildcard DNS CVE-2002-0840

Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header.

Update Released: 3rd October 2002
Affects: 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
moderate: CGI scripts source revealed using WebDAV CVE-2002-1156

In Apache 2.0.42 only, for a location where both WebDAV and CGI were enabled, a POST request to a CGI script would reveal the CGI source to a remote user.

Update Released: 3rd October 2002
Affects: 2.0.42
Fixed in Apache httpd 2.0.42
moderate: mod_dav crash CVE-2002-1593

A flaw was found in handling of versioning hooks in mod_dav. An attacker could send a carefully crafted request in such a way to cause the child process handling the connection to crash. This issue will only result in a denial of service where a threaded process model is in use.

Update Released: 24th September 2002
Affects: 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35
Fixed in Apache httpd 2.0.40
important: Path vulnerability CVE-2002-0661

Certain URIs would bypass security and allow users to invoke or access any file depending on the system configuration. Affects Windows, OS2, Netware and Cygwin platforms only.

Update Released: 9th August 2002
Affects: 2.0.39, 2.0.37, 2.0.36, 2.0.35
low: Path revealing exposures CVE-2002-0654

A path-revealing exposure was present in multiview type map negotiation (such as the default error documents) where a module would report the full path of the typemapped .var file when multiple documents or no documents could be served. Additionally a path-revealing exposure in cgi/cgid when Apache fails to invoke a script. The modules would report "couldn't create child process /path-to-script/script.pl" revealing the full path of the script.

Update Released: 9th August 2002
Affects: 2.0.39, 2.0.37?, 2.0.36?, 2.0.35?
Fixed in Apache httpd 2.0.37
critical: Apache Chunked encoding vulnerability CVE-2002-0392

Malicious requests can cause various effects ranging from a relatively harmless increase in system resources through to denial of service attacks and in some cases the ability to execute arbitrary remote code.

Update Released: 18th June 2002
Affects: 2.0.36, 2.0.35
Fixed in Apache httpd 2.0.36
low: Warning messages could be displayed to users CVE-2002-1592

In some cases warning messages could get returned to end users in addition to being recorded in the error log. This could reveal the path to a CGI script for example, a minor security exposure.

Update Released: 8th May 2002
Affects: 2.0.35
2010/08/09 13:51 2010/08/09 13:51
트랙백 0개, 댓글 0개가 달렸습니다.

Apache Security 1.3.x

Web Server/Apache 2010/08/09 13:50
Apache httpd 1.3 vulnerabilities

This page lists all security vulnerabilities fixed in released versions of Apache httpd 1.3. Each vulnerability is given a security impact rating by the Apache security team - please note that this rating may well vary from platform to platform. We also list the versions of Apache httpd the flaw is known to affect, and where a flaw has not been verified list the version with a question mark.

Please note that if a vulnerability is shown below as being fixed in a "-dev" release then this means that a fix has been applied to the development source tree and will be part of an upcoming full release.

This page is created from a database of vulnerabilities originally populated by Apache Week. Please send comments or corrections for these vulnerabilities to the Security Team.

Fixed in Apache httpd 1.3.42
moderate: mod_proxy overflow on 64-bit systems CVE-2010-0010

An incorrect conversion between numeric types flaw was found in the mod_proxy module which affects some 64-bit architecture systems. A malicious HTTP server to which requests are being proxied could use this flaw to trigger a heap buffer overflow in an httpd child process via a carefully crafted response.

Update Released: 3rd February 2010
Affects: 1.3.41, 1.3.39, 1.3.37, 1.3.36, 1.3.35, 1.3.34, 1.3.33, 1.3.32, 1.3.31, 1.3.29, 1.3.28, 1.3.27, 1.3.26, 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2
Fixed in Apache httpd 1.3.41
moderate: mod_status XSS CVE-2007-6388

A flaw was found in the mod_status module. On sites where mod_status is enabled and the status pages were publicly accessible, a cross-site scripting attack is possible. Note that the server-status page is not enabled by default and it is best practice to not make this publicly available.

Update Released: 19th January 2008
Affects: 1.3.39, 1.3.37, 1.3.36, 1.3.35, 1.3.34, 1.3.33, 1.3.32, 1.3.31, 1.3.29, 1.3.28, 1.3.27, 1.3.26, 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2
moderate: mod_imap XSS CVE-2007-5000

A flaw was found in the mod_imap module. On sites where mod_imap is enabled and an imagemap file is publicly available, a cross-site scripting attack is possible.

Update Released: 19th January 2008
Affects: 1.3.39, 1.3.37, 1.3.36, 1.3.35, 1.3.34, 1.3.33, 1.3.32, 1.3.31, 1.3.29, 1.3.28, 1.3.27, 1.3.26, 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2, 1.3.1, 1.3.0
Fixed in Apache httpd 1.3.39
moderate: mod_status cross-site scripting CVE-2006-5752

A flaw was found in the mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. Note that the server-status page is not enabled by default and it is best practice to not make this publicly available.

Update Released: 7th September 2007
Affects: 1.3.37, 1.3.36, 1.3.35, 1.3.34, 1.3.33, 1.3.32, 1.3.31, 1.3.29, 1.3.28, 1.3.27, 1.3.26, 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2
moderate: Signals to arbitrary processes CVE-2007-3304

The Apache HTTP server did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the HTTP server could manipulate the scoreboard and cause arbitrary processes to be terminated which could lead to a denial of service.

Update Released: 7th September 2007
Affects: 1.3.37, 1.3.36, 1.3.35, 1.3.34, 1.3.33, 1.3.32, 1.3.31, 1.3.29, 1.3.28, 1.3.27, 1.3.26, 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2, 1.3.1, 1.3.0
Fixed in Apache httpd 1.3.37
important: mod_rewrite off-by-one error CVE-2006-3747

An off-by-one flaw exists in the Rewrite module, mod_rewrite. Depending on the manner in which Apache httpd was compiled, this software defect may result in a vulnerability which, in combination with certain types of Rewrite rules in the web server configuration files, could be triggered remotely. For vulnerable builds, the nature of the vulnerability can be denial of service (crashing of web server processes) or potentially allow arbitrary code execution.

Update Released: 27th July 2006
Affects: 1.3.36, 1.3.35, 1.3.34, 1.3.33, 1.3.32, 1.3.31, 1.3.29, 1.3.28
Fixed in Apache httpd 1.3.35
moderate: Expect header Cross-Site Scripting CVE-2006-3918

A flaw in the handling of invalid Expect headers. If an attacker can influence the Expect header that a victim sends to a target site they could perform a cross-site scripting attack. It is known that some versions of Flash can set an arbitrary Expect header which can trigger this flaw. Not marked as a security issue for 2.0 or 2.2 as the cross-site scripting is only returned to the victim after the server times out a connection.

Update Released: 1st May 2006
Affects: 1.3.34, 1.3.33, 1.3.32, 1.3.31, 1.3.29, 1.3.28, 1.3.27, 1.3.26, 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3
moderate: mod_imap Referer Cross-Site Scripting CVE-2005-3352

A flaw in mod_imap when using the Referer directive with image maps. In certain site configurations a remote attacker could perform a cross-site scripting attack if a victim can be forced to visit a malicious URL using certain web browsers.

Update Released: 1st May 2006
Affects: 1.3.34, 1.3.33, 1.3.32, 1.3.31, 1.3.29, 1.3.28, 1.3.27, 1.3.26, 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2, 1.3.1, 1.3.0
Fixed in Apache httpd 1.3.33
moderate: mod_include overflow CVE-2004-0940

A buffer overflow in mod_include could allow a local user who is authorised to create server side include (SSI) files to gain the privileges of a httpd child.

Update Released: 28th October 2004
Affects: 1.3.32, 1.3.31, 1.3.29, 1.3.28, 1.3.27, 1.3.26, 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2, 1.3.1, 1.3.0
Fixed in Apache httpd 1.3.32
moderate: mod_proxy buffer overflow CVE-2004-0492

A buffer overflow was found in the Apache proxy module, mod_proxy, which can be triggered by receiving an invalid Content-Length header. In order to exploit this issue an attacker would need to get an Apache installation that was configured as a proxy to connect to a malicious site. This would cause the Apache child processing the request to crash, although this does not represent a significant Denial of Service attack as requests will continue to be handled by other Apache child processes. This issue may lead to remote arbitrary code execution on some BSD platforms.

Update Released: 20th October 2004
Affects: 1.3.31, 1.3.29, 1.3.28, 1.3.27, 1.3.26
Fixed in Apache httpd 1.3.31
important: listening socket starvation CVE-2004-0174

A starvation issue on listening sockets occurs when a short-lived connection on a rarely-accessed listening socket will cause a child to hold the accept mutex and block out new connections until another connection arrives on that rarely-accessed listening socket. This issue is known to affect some versions of AIX, Solaris, and Tru64; it is known to not affect FreeBSD or Linux.

Update Released: 12th May 2004
Affects: 1.3.29, 1.3.28?, 1.3.27?, 1.3.26?, 1.3.24?, 1.3.22?, 1.3.20?, 1.3.19?, 1.3.17?, 1.3.14?, 1.3.12?, 1.3.11?, 1.3.9?, 1.3.6?, 1.3.4?, 1.3.3?, 1.3.2?, 1.3.1?, 1.3.0?
important: Allow/Deny parsing on big-endian 64-bit platforms CVE-2003-0993

A bug in the parsing of Allow/Deny rules using IP addresses without a netmask on big-endian 64-bit platforms causes the rules to fail to match.

Update Released: 12th May 2004
Affects: 1.3.29, 1.3.28, 1.3.27, 1.3.26, 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2, 1.3.1, 1.3.0
low: Error log escape filtering CVE-2003-0020

Apache does not filter terminal escape sequences from error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.

Update Released: 12th May 2004
Affects: 1.3.29, 1.3.28, 1.3.27, 1.3.26, 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2, 1.3.1, 1.3.0
low: mod_digest nonce checking CVE-2003-0987

mod_digest does not properly verify the nonce of a client response by using a AuthNonce secret. This could allow a malicious user who is able to sniff network traffic to conduct a replay attack against a website using Digest protection. Note that mod_digest implements an older version of the MD5 Digest Authentication specification which is known not to work with modern browsers. This issue does not affect mod_auth_digest.

Update Released: 12th May 2004
Affects: 1.3.29, 1.3.28, 1.3.27, 1.3.26, 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2, 1.3.1, 1.3.0
Fixed in Apache httpd 1.3.29
low: Local configuration regular expression overflow CVE-2003-0542

By using a regular expression with more than 9 captures a buffer overflow can occur in mod_alias or mod_rewrite. To exploit this an attacker would need to be able to create a carefully crafted configuration file (.htaccess or httpd.conf)

Update Released: 27th October 2003
Affects: 1.3.28, 1.3.27, 1.3.26, 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2, 1.3.1, 1.3.0
Fixed in Apache httpd 1.3.28
important: RotateLogs DoS CVE-2003-0460

The rotatelogs support program on Win32 and OS/2 would quit logging and exit if it received special control characters such as 0x1A.

Update Released: 18th July 2003
Affects: 1.3.27, 1.3.26?, 1.3.24?, 1.3.22?, 1.3.20?, 1.3.19?, 1.3.17?, 1.3.14?, 1.3.12?, 1.3.11?, 1.3.9?, 1.3.6?, 1.3.4?, 1.3.3?, 1.3.2?, 1.3.1?, 1.3.0?
Fixed in Apache httpd 1.3.27
important: Buffer overflows in ab utility CVE-2002-0843

Buffer overflows in the benchmarking utility ab could be exploited if ab is run against a malicious server

Update Released: 3rd October 2002
Affects: 1.3.26, 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2, 1.3.1, 1.3.0
important: Shared memory permissions lead to local privilege escalation CVE-2002-0839

The permissions of the shared memory used for the scoreboard allows an attacker who can execute under the Apache UID to send a signal to any process as root or cause a local denial of service attack.

Update Released: 3rd October 2002
Affects: 1.3.26, 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2, 1.3.1, 1.3.0
low: Error page XSS using wildcard DNS CVE-2002-0840

Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header.

Update Released: 3rd October 2002
Affects: 1.3.26, 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2, 1.3.1, 1.3.0
Fixed in Apache httpd 1.3.26
critical: Apache Chunked encoding vulnerability CVE-2002-0392

Requests to all versions of Apache 1.3 can cause various effects ranging from a relatively harmless increase in system resources through to denial of service attacks and in some cases the ability to be remotely exploited.

Update Released: 18th June 2002
Affects: 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2, 1.3.1, 1.3.0
low: Filtered escape sequences CVE-2003-0083

Apache does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences,

Update Released: 18th June 2002
Affects: 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2, 1.3.1, 1.3.0
Fixed in Apache httpd 1.3.24
critical: Win32 Apache Remote command execution CVE-2002-0061

Apache for Win32 before 1.3.24 and 2.0.34-beta allows remote attackers to execute arbitrary commands via parameters passed to batch file CGI scripts.

Update Released: 22nd March 2002
Affects: 1.3.22, 1.3.20?, 1.3.19?, 1.3.17?, 1.3.14?, 1.3.12?, 1.3.11?, 1.3.9?, 1.3.6?, 1.3.4?, 1.3.3?, 1.3.2?, 1.3.1?, 1.3.0?
Fixed in Apache httpd 1.3.22
important: Requests can cause directory listing to be displayed CVE-2001-0729

A vulnerability was found in the Win32 port of Apache 1.3.20. A client submitting a very long URI could cause a directory listing to be returned rather than the default index page.

Update Released: 12th October 2001
Affects: 1.3.20
important: Multiviews can cause a directory listing to be displayed CVE-2001-0731

A vulnerability was found when Multiviews are used to negotiate the directory index. In some configurations, requesting a URI with a QUERY_STRING of M=D could return a directory listing rather than the expected index page.

Update Released: 12th October 2001
Affects: 1.3.20, 1.3.19?, 1.3.17?, 1.3.14?, 1.3.12?, 1.3.11?, 1.3.9?, 1.3.6?, 1.3.4?, 1.3.3?, 1.3.2?, 1.3.1?, 1.3.0?
moderate: split-logfile can cause arbitrary log files to be written to CVE-2001-0730

A vulnerability was found in the split-logfile support program. A request with a specially crafted Host: header could allow any file with a .log extension on the system to be written to.

Update Released: 12th October 2001
Affects: 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2, 1.3.1, 1.3.0
Fixed in Apache httpd 1.3.20
important: Denial of service attack on Win32 and OS2 CVE-2001-1342

A vulnerability was found in the Win32 and OS2 ports of Apache 1.3. A client submitting a carefully constructed URI could cause a General Protection Fault in a child process, bringing up a message box which would have to be cleared by the operator to resume operation. This vulnerability introduced no identified means to compromise the server other than introducing a possible denial of service.

Update Released: 22nd May 2001
Affects: 1.3.20, 1.3.19?, 1.3.17?, 1.3.14?, 1.3.12?, 1.3.11?, 1.3.9?, 1.3.6?, 1.3.4?, 1.3.3?, 1.3.2?, 1.3.1?, 1.3.0?
Fixed in Apache httpd 1.3.19
important: Requests can cause directory listing to be displayed CVE-2001-0925

The default installation can lead mod_negotiation and mod_dir or mod_autoindex to display a directory listing instead of the multiview index.html file if a very long path was created artificially by using many slashes.

Update Released: 28th February 2001
Affects: 1.3.17, 1.3.14, 1.3.12, 1.3.11
Fixed in Apache httpd 1.3.14
important: Rewrite rules that include references allow access to any file CVE-2000-0913

The Rewrite module, mod_rewrite, can allow access to any file on the web server. The vulnerability occurs only with certain specific cases of using regular expression references in RewriteRule directives: If the destination of a RewriteRule contains regular expression references then an attacker will be able to access any file on the server.

Update Released: 13th October 2000
Affects: 1.3.12, 1.3.11?, 1.3.9?, 1.3.6?, 1.3.4?, 1.3.3?, 1.3.2?, 1.3.1?, 1.3.0?
important: Mass virtual hosting can display CGI source CVE-2000-1204

A security problem for users of the mass virtual hosting module, mod_vhost_alias, causes the source to a CGI to be sent if the cgi-bin directory is under the document root. However, it is not normal to have your cgi-bin directory under a document root.

Update Released: 13th October 2000
Affects: 1.3.12, 1.3.11, 1.3.9
moderate: Requests can cause directory listing to be displayed on NT CVE-2000-0505

A security hole on Apache for Windows allows a user to view the listing of a directory instead of the default HTML page by sending a carefully constructed request.

Update Released: 13th October 2000
Affects: 1.3.12, 1.3.11?, 1.3.9?, 1.3.6?, 1.3.4?, 1.3.3?, 1.3.2?, 1.3.1?, 1.3.0?
Fixed in Apache httpd 1.3.12
important: Cross-site scripting can reveal private session information CVE-2000-1205

Apache was vulnerable to cross site scripting issues. It was shown that malicious HTML tags can be embedded in client web requests if the server or script handling the request does not carefully encode all information displayed to the user. Using these vulnerabilities attackers could, for example, obtain copies of your private cookies used to authenticate you to other sites.

Update Released: 25th February 2000
Affects: 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2, 1.3.1, 1.3.0
Fixed in Apache httpd 1.3.11
moderate: Mass virtual hosting security issue CVE-2000-1206

A security problem can occur for sites using mass name-based virtual hosting (using the new mod_vhost_alias module) or with special mod_rewrite rules.

Update Released: 21st January 2000
Affects: 1.3.9, 1.3.6?, 1.3.4?, 1.3.3?, 1.3.2?, 1.3.1?, 1.3.0?
Fixed in Apache httpd 1.3.4
important: Denial of service attack on Win32

There have been a number of important security fixes to Apache on Windows. The most important is that there is much better protection against people trying to access special DOS device names (such as "nul").

Update Released: 11th January 1999
Affects: 1.3.3, 1.3.2, 1.3.1, 1.3.0
Fixed in Apache httpd 1.3.2
important: Multiple header Denial of Service vulnerability CVE-1999-1199

A serious problem exists when a client sends a large number of headers with the same header name. Apache uses up memory faster than the amount of memory required to simply store the received data itself. That is, memory use increases faster and faster as more headers are received, rather than increasing at a constant rate. This makes a denial of service attack based on this method more effective than methods which cause Apache to use memory at a constant rate, since the attacker has to send less data.

Update Released: 23rd September 1998
Affects: 1.3.1, 1.3.0
important: Denial of service attacks

Apache 1.3.2 has better protection against denial of service attacks. These are when people make excessive requests to the server to try and prevent other people using it. In 1.3.2 there are several new directives which can limit the size of requests (these directives all start with the word Limit).

Update Released: 23rd September 1998
Affects: 1.3.1, 1.3.0
2010/08/09 13:50 2010/08/09 13:50
트랙백 0개, 댓글 0개가 달렸습니다.

Tomcat 사용 시 Access Log 기록 방법

Web Server/Tomcat 2010/01/11 09:24

Tomcat 사용 시 Access Log를 기록하는 방법은 다음과 같습니다.

$CATALINA_HOME/conf/server.xml 파일 내용 중 아래 부분의 주석을 제거하신 후 Tomcat을 재 시작하시면 됩니다.

        <!--
        <Valve className="org.apache.catalina.valves.AccessLogValve"
                 directory="logs"  prefix="localhost_access_log." suffix=".txt"
                 pattern="common" resolveHosts="false"/>
        -->

 <Valve className="org.apache.catalina.valves.AccessLogValve"
directory="/apps/atlassian/logs" prefix="" suffix=".tomcat2_access.log"
pattern="%t %a %Ts %{userid}r %B %U%q"
fileDateFormat="yyyy-MM-dd"
resolveHosts="false"/>

참조: http://tomcat.apache.org/tomcat-5.5-doc/config/valve.html

  • %a - Remote IP address
  • %A - Local IP address
  • %b - Bytes sent, excluding HTTP headers, or '-' if zero
  • %B - Bytes sent, excluding HTTP headers
  • %h - Remote host name (or IP address if resolveHosts is false)
  • %H - Request protocol
  • %l - Remote logical username from identd (always returns '-')
  • %m - Request method (GET, POST, etc.)
  • %p - Local port on which this request was received
  • %q - Query string (prepended with a '?' if it exists)
  • %r - First line of the request (method and request URI)
  • %s - HTTP status code of the response
  • %S - User session ID
  • %t - Date and time, in Common Log Format
  • %u - Remote user that was authenticated (if any), else '-'
  • %U - Requested URL path
  • %v - Local server name
  • %D - Time taken to process the request, in millis
  • %T - Time taken to process the request, in seconds
  • %I - current request thread name (can compare later with stacktraces)
2010/01/11 09:24 2010/01/11 09:24
트랙백 0개, 댓글 0개가 달렸습니다.

CentOS5.2에 Proftpd 설치하고 xinetd 방식으로 사용하기

FAQ 2009/05/06 13:58
CentOS5.2에 Proftpd 설치하고 xinetd 방식으로 사용하기

0)proftpd 컴파일과 설치를 위해서 다음 패키지를 설치한다
# yum install gcc gcc-c++

1)소스 파일 다운로드
# wget ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.2rc1.tar.gz
2)압축 풀고 생성된 디렉토리로 이동
# tar zxvf proftpd-1.3.2rc1.tar.gz
# cd proftpd-1.3.2rc1.tar.gz
3) 설정 컴파일 설치
# ./configure --with-modules=wrap-modules
# make
# make install
4)ftp 디렉토리 추가하고 테스트 파일 생성
# mkdir /home/ftp
# touch /home/ftp/test.txt
5)proftpd 설정 파일에서 다음을 수정하자 (/usr/local/etc/proftpd.conf)
# UseIPv6    off 주석 처리
<Anonymous /home/ftp>
참고 : ~ftp는 /var/ftp/pub 디렉토리를 의미한다

6)방화벽 21/tcp port 개방
vim /etc/sysconfig/iptables
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 21 -j ACCEPT
/etc/init.d/iptables restart

7)standalone 모드로 실행해 보자
/usr/local/sbin/proftpd
ftp localhost
Name (192.168.0.3:testman): anonymous
Password: # 여기서 그냥 엔터 누르면 됩니다

8)프로세스 죽이기
pkill -9 proftpd

xinetd 방식으로 사용해보자
1)
/usr/local/etc/proftpd.conf에서
ServerType inetd로 수정 
2)
/etc/xinetd.d 디렉토리에 proftpd 파일 생성 다음 내용 추가
service ftp
{
    flags = REUSE
    socket_type = stream
    wait    = no
    user = root
    server = /usr/local/sbin/in.proftpd
    log_on_failure += USERID
    disable    = no
}
3)xinetd 재시작
/etc/init.d/xinetd.d restart
4) 익명으로 접속이 가능한지 확인해 보자
ftp 192.168.0.3
Name (192.168.0.3:testman): anonymous
Password:
230 Anonymous access granted, restrictions apply
ftp>
접속 성공
5)am9시부터 pm1시까지만 ftp를 사용 가능하게 하고 싶다면 다음과 같이 하면 된다
vim /etc/xinetd.d/proftpd
service ftp
{
    flags = REUSE
    socket_type = stream
    wait    = no
    user = root
    server = /usr/local/sbin/in.proftpd
    access_times = 09:00-13:00
    log_on_failure += USERID
    disable    = no
}
xinetd 재시작
# /etc/init.d/xinetd restart

# ftp 192.168.0.3
Connected to 192.168.0.3.
421 Service not available, remote server has closed connection
지정한 시간 이외의 시간에 접속하면
위와 같은 메세지와 함께 접속이 불가하다

2009/05/06 13:58 2009/05/06 13:58
트랙백 0개, 댓글 0개가 달렸습니다.

보안서버 SSL 구동시 비밀번호 자동 입력 및 부팅시 자동 시작

Web Server/Apache 2009/03/25 08:50
[root@smson ssl]# vi pw.sh
#!/bin/sh
echo "password"
[root@smson ssl]# vi /usr/local/apache-ssl/conf/httpd.conf
<IfModule mod_ssl.c>
#   Pass Phrase Dialog:
#   Configure the pass phrase gathering process.
#   The filtering dialog program (`builtin' is a internal
#   terminal dialog) has to provide the pass phrase on stdout.
#SSLPassPhraseDialog  builtin
SSLPassPhraseDialog  exec:/usr/local/apache-ssl/conf/ssl/pw.sh

/usr/local/apache/bin/apachectl startssl
2009/03/25 08:50 2009/03/25 08:50
트랙백 0개, 댓글 0개가 달렸습니다.

bridge-firewall

분류없음 2009/01/06 15:18 
cat /etc/init.d/bridge 
#! /bin/bash
#
# bridge       Bring up/down bridge
#
# chkconfig: 2345 9 91
# description: Activates/Deactivates all bridge interfaces configured to \
#              start at boot time.
# probe: true
### BEGIN INIT INFO
# Provides: $bridge
### END INIT INFO

# See how we were called.
case "$1" in
  start)
        brctl addbr br
        brctl addif br eth0
        brctl addif br eth1
        /sbin/ifconfig eth0 0.0.0.0 up
        /sbin/ifconfig eth1 0.0.0.0 up
        /sbin/ifconfig br up
        /sbin/ifconfig br 10.50.0.1 up
        ;;
  stop)
        brctl delif br eth1
        brctl delif br eth0
        brctl delbr br
        ;;
  status)
        brctl showmacs br
        ;;
  restart|reload)
        cd $CWD
        $0 stop
        $0 start
        ;;
  *)
        echo $"Usage: $0 {start|stop|restart|reload|status}"
        exit 1
esac

exit 0

 

cat /etc/sysconfig/iptables
# Generated by iptables-save v1.2.9 on Thu Dec  9 10:08:33 2004
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [242:27601]
:OUTPUT ACCEPT [4445:1628609]
:RH-Firewall-1-INPUT - [0:0]

################################################################################
# Chain create
################################################################################
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT


################################################################################
# Public
################################################################################
# 잘못된 패킷 차단
#-A RH-Firewall-1-INPUT -m state --state INVALID -j DROP

# 로컬호스트에서의 모든패킷허용
-A RH-Firewall-1-INPUT -i lo -j ACCEPT

# 서브넷에서의 내,외부로 모든패킷허용
-A RH-Firewall-1-INPUT -s 211.212.213.0/255.255.255.0 -j ACCEPT

# 서브넷에서의 내,외부로 ping 허용
-A RH-Firewall-1-INPUT -s 211.212.213.0/255.255.255.0 -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.50.0.0/24 -p icmp -m icmp --icmp-type 8 -j ACCEPT

# 내부에서 외부로 나가는 tcp 모두허용
-A RH-Firewall-1-INPUT -p tcp -m tcp --sport 20 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state ESTABLISHED -m tcp --sport 1:65535 --dport 1:65535 -j ACCEPT

# 내부서브넷에서 외부로 나가는 udp 모두허용
-A RH-Firewall-1-INPUT -p udp -m udp --sport 1:65535 -j ACCEPT


################################################################################
# Firewall level
################################################################################
# SSH
-A RH-Firewall-1-INPUT -d 10.50.0.1 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 22 -j ACCEPT

# ntop
-A RH-Firewall-1-INPUT -d 10.50.0.1 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 3000 -j ACCEPT


################################################################################
# Desktop level
################################################################################
# MSN
-A RH-Firewall-1-INPUT -p tcp -d 211.212.213.0/255.255.255.0 --dport 1863:1864 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -d 211.212.213.0/255.255.255.0 --dport 6901 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -d 211.212.213.0/255.255.255.0 --dport 7801:7825 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -d 211.212.213.0/255.255.255.0 --dport 6891:6900 -j ACCEPT

# edonkey
-A RH-Firewall-1-INPUT -p tcp -d 211.212.213.0/255.255.255.0 --dport 4662 -j ACCEPT


################################################################################
# Server level
################################################################################

# SMTP/WWW/POP3
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 25 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 110 -j ACCEPT

# DNS
-A RH-Firewall-1-INPUT -d 211.212.213.214 -p udp -m udp --dport 53 -j ACCEPT
-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 53 -j ACCEPT

# SSH
-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 22 -j ACCEPT

# Samba
-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 139 -j ACCEPT

# 윈도우 네트워크 드라이브
#-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 139 -j ACCEPT
#-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 445 -j ACCEPT
#-A RH-Firewall-1-INPUT -d 211.212.213.214 -p udp -m state --state NEW,ESTABLISHED -m udp --dport 137 -j ACCEPT
#-A RH-Firewall-1-INPUT -d 211.212.213.214 -p udp -m state --state NEW,ESTABLISHED -m udp --dport 138 -j ACCEPT

# FTP
-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state RELATED,ESTABLISHED -m tcp --dport 20 -j ACCEPT
-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 21 -j ACCEPT

# ms-sql
#-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 1433 -j ACCEPT
#-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m udp --dport 1433 -j ACCEPT

# oracle
#-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 1522 -j ACCEPT

# Terminal service
-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 3389 -j ACCEPT


################################################################################
# DROP
################################################################################

# 외부에서 내부로의 TCP 를 차단.  내부에서 외부로의 TCP 는 막지않음.
-A RH-Firewall-1-INPUT -p tcp --syn -d 211.212.213.0/255.255.255.0 -j DROP

# ping 차단
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type 8 -j REJECT --reject-with icmp-port-unreachable

COMMIT
# Completed on Thu Dec  9 10:08:33 2004
2009/01/06 15:18 2009/01/06 15:18
트랙백 0개, 댓글 0개가 달렸습니다.

FTPPUT

분류없음 2008/08/06 14:16 
#!/usr/bin/perl -w
#
# $Id: //websites/unixwiz/unixwiz.net/webroot/tools/ftpput.txt#1 $
#
# written by :	Stephen J. Friedl
#               Software Consultant
#               Tustin, California USA
#
#	This very simple program is a kind of inverse to wget for ftp: it
#	*puts* files to a remote FTP server and returns an exit code that
#	reports accurately success or failure.
#
#	All the parameters are given on the command line (no .netrc support)
#
# COMMAND LINE PARAMS
# --------------------
#
# --help	Display a short help listing
#
# --server=S    Use "S" as the remote FTP server to connect to. We don't
#               need the leading "ftp://" part (but it's stripped off if
#               provided). This is REQUIRED.
#
# --user=U      Use "U" as the login name as required by the remote machine.
#               In the absense of one, "anonymous" is used.
#
# --pass=P      Use "P" for the password on the remote machine.
#
# --dir=D       Change to directory D on the remote system before doing
#               any transfers. If not provided, the directory is not
#               changed before doing a transfer.
#
# --passive     Use passive (PASV) mode for this transfer, which is
#               required by some servers and some firewalls. If not
#               specified, active mode is used.
#
# --hash        Print a hash mark ("#") every 1024 bytes during the transfer
#               to watch it run. 
#
# --verbose     Show the name of each file being sent. This is much less info
#               than the --debug option
#

use strict;
use warnings;
use Net::FTP;

my $Version = "unixwiz.net ftpput - version 1.0 (2003/05/09)";

my $server  = undef;
my $user    = undef;
my $pass    = undef;
my $dir     = undef;
my $debug   = 0;
my $hash    = 0;
my $passive = 0;
my $binary  = 0;
my $ascii   = 0;
my $verbose = 0;

my @FILES = ();

foreach ( @ARGV )
{
	if ( m/^--help/i )
	{
		print STDERR <<EOF;
$Version

usage: $0 [options] --server=SVR file files...

  --help        Show this brief help listing
  --debug       Enable debugging
  --server=SVR  Send to FTP server SVR
  --user=U      Login as user U (default = anonymous)
  --pass=P      Use password P (default = "-anonymous\@")
  --dir=D       Change to directory D on remote system
  --passive     Use passive mode instead of active
  --binary      Select binary mode
  --ascii       Select ASCII mode
  --hash        Print a hash (#) every 1024 bytes during transfer
  --verbose     Show each filename as it's being sent

  Full pathnames on the command line do NOT translate into directory
  names on the remote machine: the --dir=D parameter determines the
  final location exclusively. This program does not consult any .netrc
  files.

  This program exits 0=success and nonzero=failure.
EOF
		exit 1;
	}
	elsif ( m/^--user=(.+)$/ )                      # --user=U
	{
		$user = $1;
	}
	elsif ( m/^--pass(?:word)?=(.+)$/ )             # --pass=PASS
	{
		$pass = $1;
	}
	elsif ( m/^--dir=(.+)$/ )                       # --dir=DIR
	{
		$dir = $1;
	}
	elsif ( m/^--server=(.+)$/ )                    # --server=SVR
	{
		$server = $1;
	}
	elsif ( m/^--debug$/ )                          # --debug
	{
		$debug++;
	}
	elsif ( m/^--verbose$/ )                        # --verbose
	{
		$verbose++;
	}
	elsif ( m/^--passive$/ )                        # --passive
	{
		$passive = 1;
	}
	elsif ( m/^--hash$/ )                           # --hash
	{
		$hash = 1;
	}
	elsif ( m/^--binary$/ )                         # --binary
	{
		$binary = 1;
	}
	elsif ( m/^--ascii$/i )                         # --ascii
	{
		$ascii = 1;
	}
	elsif ( m/^-/ )
	{
		die "ERROR: {$_} is an invalid cmdline parameter\n";
	}
	elsif ( -r $_ )
	{
		push @FILES, $_;
	}
	else
	{
		die "ERROR: cannot open file {$_} for reading\n";
	}
}
	
#------------------------------------------------------------------------
# SANITY CHECKING ON PARAMETERS
#

$server =~ s|^ftp://||	if $server;

die "ERROR: missing file to send (try --help)\n"	if @FILES == 0;
die "ERROR: missing --server (try --help)\n"		if not $server;
die "ERROR: can't provide both --binary and --ascii\n" if $binary and $ascii;

$user = "anonymous"			if not $user;

my $ftp;

my %FTPARGS = ();

$FTPARGS{Debug}   = $debug		if $debug;
$FTPARGS{Passive} = $passive		if $passive;
$FTPARGS{Hash}    = $hash		if $hash;

if ( not ( $ftp = Net::FTP->new( $server, %FTPARGS) ) )
{
	die "ERROR: cannot connect to FTP server $server\n";
}

if ( not $ftp->login($user, $pass) )
{
	die "ERROR: cannot login to $server with user $user\n";
}

if ( $dir )
{
	$ftp->cwd($dir) or die "ERROR: cannot cwd($dir)\n";
}
if ( $binary  )
{
	$ftp->binary() or die "ERROR: cannot set binary mode\n";
}
if ( $ascii )
{
	$ftp->ascii() or die "ERROR: cannot set ASCII mode\n";
}

foreach my $file ( @FILES )
{
	print "--> put $file\n"		if $verbose;

	if ( not $ftp->put($file) )
	{
		die "ERROR: cannot send $file\n";
	}

	print "    (sent OK)\n"		if $verbose;
}

$ftp->quit or die "ERROR: cannot quit FTP transfer\n";

exit 0;
2008/08/06 14:16 2008/08/06 14:16
트랙백 0개, 댓글 0개가 달렸습니다.

리눅스 스트리밍

분류없음 2008/01/22 08:54

상용 스트리밍 솔루션
http://www.elecard.com/download/

2008/01/22 08:54 2008/01/22 08:54
트랙백 0개, 댓글 0개가 달렸습니다.

리눅스 여러문서에서 문자열 검색 및 변환 팁 정리

Shell Script 2007/12/06 17:11
리눅스 여러문서에서 문자열 검색 및 변환 팁 정리

문자열찾기 방법 1 - 영어만 주로 가능
# grep -rw "찾는문자열" ./

문자열찾기 방법 2 - 대/소문자 구분 안하고 검색
# grep -i -l "찾는문자열" * -r 2> /dev/null

문자열찾기 방법 3 - 한글, 영어 모두 가능
# find . -exec grep -l "찾는문자열" {} ; 2>/dev/null

문자열찾기 방법 4 - 한글,영어, 대소문자 안가리고 검색
# find . -exec grep -i -l "찾을문자열" {} ; 2>/dev/null

문자열찾은 후 치환
# find . -exec perl -pi -e 's/찾을문자열/바꿀문자열/g' {} ; 2>/dev/null

파일명 찾기
# find / -name 파일명 -type f

파일명 찾기(대소문자 구별없음)
# find / -iname 파일명 -type f

디렉토리 찾기
# find / -name 파일명 -type d

디렉토리 찾기(대소문자 구별없음)
# find / -iname 파일명 -type d
2007/12/06 17:11 2007/12/06 17:11
트랙백 0개, 댓글 0개가 달렸습니다.

쉘에서 문자열 길이 구하기

Shell Script 2007/11/29 20:08

문자열 길이
string=abcd
echo ${#string} #4
echo `expr length $string` #4
echo `expr "$string" : '.*'` #4

2007/11/29 20:08 2007/11/29 20:08
트랙백 0개, 댓글 0개가 달렸습니다.

Apache RedirectMatch 설정

Web Server/Apache 2007/10/17 09:20

RedirectMatch ^/([^./]+)$ /check.php?id=$1

이 설정의도는

/abc ---> /check.php?id=abc (redirect 의도)
/ccc ---> /check.php?id=ccc (redirect 의도)
/abc/ ---> /abc/
/abc.php ---> /abc.php

이와 같은 결과가 되도록 설정했지만 애석하게도 제대로 Redirect
되지 않습니다.
이유는 아파치의 Redirect 는 ? 문자가 인코딩(%3f)되어 넘어가기
때문에 PHP 파일에서는 요청쿼리로 해석하지 않고 완전한 하나의
파일로 인식하기 때문입니다.

실제로 첫번째 redirect 결과는

/abc ---> /check.php%3fid=abc (redirect 의도 실패)

이렇게 넘어가서 404 에러를 내게 됩니다.

해결방법은 ?(쿼리)를 사용하지 않고 PATH_INFO 환경변수가 생기도록
다음과 같은 방법을 사용하는것이 좋습니다.

권장설정)

RedirectMatch ^/([^./]+)$ /check.php/id=$1
or
RedirectMatch ^/([^./]+)$ /check.php/$1
or
RedirectMatch ^/([^./]+)$ /check/id=$1
or
RedirectMatch ^/([^./]+)$ /check/$1

sample>
RedirectMatch /v/(.*)\.swf$ http://www.maxpd.com/player/player.swf?videoId=$1

2007/10/17 09:20 2007/10/17 09:20
트랙백 0개, 댓글 0개가 달렸습니다.

Tomcat heap 사이즈 조절 및 메모리 튜닝

Web Server/Tomcat 2007/10/17 09:17

* Sun Microsystyems의 자바 HotSpot VM은 힙을 세 개의 영역으로 나누고 있다.
 힙의 세 영역은 다음과 같다:
 1) Permanent space: JVM 클래스와 메소드 개체를 위해 쓰인다.
 2) Old object space: 만들어진지 좀 된 개체들을 위해 쓰인다.
 3) New(young) object space: 새로 생성된 개체들을 위해 쓰인다.

* Heap layout 할당에 영향을 주는 스위치들
명령행 스위치 설명
-------------|-------
-Xms=[n]  최소 heap size
-Xmx=[n]  최대 heap size
-XX:PermSize=[n]  최소 perm size
-XX:MaxPermSize=[n]  최대 perm size
-XX:NewSize=[n]  최소 new size
-XX:MaxNewSize=[n]  최대 new size
-XX:SurvivorRatio=[n]  New/survivor 영역 비율 
-XX:newratio=[n]  Old/new 영역 비율. HotSpot 클라이언트 VM은 8, HotSpot 서버 VM은 2.
-XX:TargetSurvivorRatio=[n]  GC동안 비울 생존자 수용 가능량 퍼센티지 (capacity percentage.) 초기값은 50%

* New Generation 메모리 할당 공식
   Eden = NewSize - ((NewSize/(SurvivorRatio + 2)) * 2)
   From space = (NewSize - Eden)/2
   To space = (NewSize - Eden)/2
* Old Generation 메모리 할당 공식
   Old = Xmx - MaxNewSize

* GC한 상태의 Heap메모리 정보출력
jdk1.4에서 -XX:+PrintGCDetails -XX:+PrintGCTimeStamps -XX:+PrintHeapAtGC 

* 정적페이지가 많을 때
-Xms418m -Xmx418m 
-XX:PermSize=1024m 
-XX:MaxPermSize=1024m 
-XX:NewSize=290m 
-XX:MaxNewSize=290m 
-XX:SurvivorRatio=3 

* 동적인 페이지가 많을 때
-Xms1024m -Xmx1024m 
-XX:PermSize=128m 
-XX:MaxPermSize=128m 
-XX:NewSize=800m 
-XX:MaxNewSize=800m 
-XX:SurvivorRatio=4 

-Xms384m -Xmx384m -XX:PermSize=256m -XX:MaxPermSize=256m -XX:NewSize=128m -XX:MaxNewSize=128m -XX:SurvivorRatio=3 

set CATALINA_OPTS=-Xms384m -Xmx384m -XX:PermSize=256m -XX:MaxPermSize=256m -XX:NewSize=128m -XX:MaxNewSize=128m -XX:SurvivorRatio=3


---------------------------------------------------------------------------



kol:/ero/bin>cat tomcat_startup.sh
#!/usr/bin/ksh
 
. /ero/bin/ero.env
 
export CATALINA_OPTS="-server -Xms4096M -Xmx4096M -XX:PermSize=64M -XX:MaxPermSize=64M -Xnoclassgc -XX:NewSize=1024M -XX:MaxNewSize=1024M -XX:+UseParNewGC -XX:ParallelGCThreads=4 -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=50 -XX:+PrintGCDetails -XX:+PrintGCTimeStamps -XX:+PrintHeapAtGC"
 
# -Xms4096M                             : 최소 heap 크기
# -Xmx4096M                             : 최대 heap 크기
#                                      
# -XX:PermSize=64M                      : 코드영역(class로딩장소) 최소값
# -XX:MaxPermSize=64M                   : ..                      최대값
# -Xnoclassgc                           : ..                      에 대해 GC를 수행하지 않음
#                                      
# -XX:NewSize=1024M                     : new 영역 최소 1G 확보
# -XX:MaxNewSize=1024M                  : ..       최대  ..
#                                      
# -XX:+UseParNewGC                      : 멈춤을 최소로하는 new영역 GC 방법사용
# -XX:ParallelGCThreads=4               : GC를 동시 수행하는  thread갯수
#                                      
# -XX:+UseConcMarkSweepGC               : 멈춤을 최소로하는 old 영역 GC 방법사용
# -XX:CMSInitiatingOccupancyFraction=50 : old영역이 50% 이상 사용되면 GC 수행

2007/10/17 09:17 2007/10/17 09:17
트랙백 0개, 댓글 0개가 달렸습니다.

server.xml 파일 한글 번역

Web Server/Tomcat 2007/10/17 09:15

xml화일의 영어 설명부분을 한글로 번역해 놓았다.


<!-- Example Server Configuration File -->
          <!-- Note: 컴포넌트들은 각각의 부모-자식 관계에 따라 중첩(nested) 되었음 -->

          <!-- "Server" 는 전체 JVM 을 나타내는 싱글톤 요소입니다. 이것은 하나 이상의
               "Service" 인스턴스를 갖고 있습니다. 서버는 지정된 포트를 통해 shutdown
               명령을 받습니다.

               Note: "Server" 는 스스로가 "Container" 가 아니기 때문에, "Valves" 또는
               "Loggers" 같은 서브 컴포넌트를 "Server" 와 같은 레벨에서 정의하면 안됩
               니다. -->

          <Server port="8005" shutdown="SHUTDOWN" debug="0">


            <!-- "Service" 는 한 개의 "Container" 를 공유하는 하나 이상의 "Connectors"
                 의 집합체입니다. (이 컨테이너 안에서 웹어플리케이션이 돌아갑니다). 보통
                 은, 이 컨테이너가 "Engine" 입니다만, 요구되지는 않습니다. 

                 Note:  "Service" 는 스스로가 "Container" 가 아니기 때문에, "Valves"
                 또는 "Loggers" 같은 서브 컴포넌트를 "Server" 와 같은 레벨에서 정의하면
                 안됩니다.
             -->

            <!-- Tomcat Stand-Alone Service 로 설정하기 -->
            <Service name="Tomcat-Standalone">

              <!-- "Connector" 는 요청을 받아서, 응답이 반환되는 종점(endpoint)을 나타냅니
                   다. 각 커넥터는 처리를 담당하는 관련된 "Container"(보통 "엔진")로 요청을
                   전달해줍니다.

                   기본값으로, 8080포트에 non-SSL HTTP/1.1 커넥터가 설정되어있습니다.
                   SSL HTTP/1.1 커넥터 역시 사용하려면 아래에 있는 지시를 따라서 하고, 두번
                   째 커넥터 엔트리의 주석표시를 지워주시면 됩니다. SSL 지원은 다음 단계를
                   거쳐야 합니다:
                   * JSSE 1.0.2 또는 이후 버전을 다운받아서 설치하고, JAR 파일들을
                     "$JAVA_HOME/jre/lib/ext" 디렉토리에 복사해 놓습니다.
                   * "$JAVA_HOME/jre/lib/security/java.security" 를 편집하고
                     security.provider.2=com.sun.net.ssl.internal.ssl.Provider 를 추가합
                     니다.
                   * 실행: keytool -genkey -alias tomcat -keyalg RSA
                     패스워드 값"changeit" 으로 실행합니다.

                   기본적으로, DNS lookups 는 웹어플리케이션이 request.getRemoteHost() 를
                   부를 때 동적하도록 되어있습니다. 이것은 성능에 영향을 줄 수 있기 때문에,
                   "enableLookups" 속성을 "false" 로 바꿔주면 이 기능을 사용하지 않을 수
                   있습니다.  DNS lookups 가 사용하지 않게 되면 request.getRemoteHost() 는
                   remote client 의 IP 주소의 String 버전을 반환할 것입니다.
              -->

              <!-- 8080 포트에 non-SSL HTTP/1.1 Connector 설정하기 -->
              <Connector className="org.apache.catalina.connector.http.HttpConnector"
                         port="80" minProcessors="5" maxProcessors="75"
                         enableLookups="true" redirectPort="8443"
                         acceptCount="10" debug="0" connectionTimeout="60000"/>
              <!-- Note : 커넥션 타임아웃을 사용하지 않으려면, connectionTimeout 값을 -1로
                수정해 주세요.-->

              <!-- 8443 포트에 SSL HTTP/1.1 Connector 설정하기 -->
              <!--
              <Connector className="org.apache.catalina.connector.http.HttpConnector"
                         port="8443" minProcessors="5" maxProcessors="75"
                         enableLookups="true"
                     acceptCount="10" debug="0" scheme="https" secure="true">
                <Factory className="org.apache.catalina.net.SSLServerSocketFactory"
                         clientAuth="false" protocol="TLS"/>
              </Connector>
              -->

              <!-- 8081 포트에 Proxied HTTP/1.1 Connector 설정하기 -->
              <!-- 사용법에 대한 자세한 내용은 proxy 문서를 보십시오. -->
              <!--
              <Connector className="org.apache.catalina.connector.http.HttpConnector"
                         port="8081" minProcessors="5" maxProcessors="75"
                         enableLookups="true"
                         acceptCount="10" debug="0" connectionTimeout="60000"
                         proxyPort="80"/>
              -->

              <!-- 8082 포트에 non-SSL HTTP/1.0 Test Connector 설정하기 -->
              <!--
              <Connector className="org.apache.catalina.connector.http10.HttpConnector"
                         port="8082" minProcessors="5" maxProcessors="75"
                         enableLookups="true" redirectPort="8443"
                         acceptCount="10" debug="0"/>
              -->

              <!-- Engine 은 (Catalina 에서) 모든 요청을 처리하는 입력지점을 나타냅니다.
                   Tomcat stand alone 용으로 구현된 Engine 은 요청에 포함된 HTTP 헤더를 분
                   석하고, 적당한 Host (가상 호스트) 로 전달하는 역할을 합니다. -->

              <!-- 컨테이너 구조에서 top level 컨테이너 설정하기 -->
              <Engine name="Standalone" defaultHost="localhost" debug="0">

                <!-- 요청 dumper 밸브는 Tomcat 의 인스턴스의 모든 요청을 받는 동안 들어온
                     요청 헤더와 쿠키, 보내질 응답 헤더와 쿠키에 대해 유용한 디버깅 정보를
                     덤프합니다. 만일 특정한 가상호스트, 또는 특정한 어플리케이션에 들어온
                     요청에만 만 관심을 갖고자 한다면, 이 요소를 해당하는 <Host> 나 <Context>
                     엔트리 아래에 위치시켜주십시오.

                     모든 서블릿 2.3 컨테이너에 유동적인 유사한 동작구조를 위해서, 예제
                     어플리케이션에 있는 "RequestDumperFilter" 필터를 확인하십시오.
                     (소스는 "$CATALINA_HOME/webapps/examples/WEB-INF/classes/filters"
                     위치에 있을 것입니다.)

                     기본적으로 Request dumping 기능은 사용하지 않는 것으로 되어있습니다.
                     다음의 요소에서 주석을 빼면 사용할 수 있습니다. -->
                <!--
                <Valve className="org.apache.catalina.valves.RequestDumperValve"/>
                -->

                <!-- 하위수준에서 지정되지 않았다면 사용되는 Global Logger -->
                <Logger className="org.apache.catalina.logger.FileLogger"
                        prefix="catalina_log." suffix=".txt"
                        timestamp="true"/>

                <!-- 이 Realm 이 여기에 있기 때문에, 인스턴스는 전체적으로 공유됩니다. -->

                <Realm className="org.apache.catalina.realm.MemoryRealm" />

                <!-- 데이터베이스에 저장되고 JDBC 를 통해서 접근하는 Realm 을 사용하려면
                     위 Realm 을 다음의 Realm 중 하나와 대치하십시오. -->

                <!--
                <Realm  className="org.apache.catalina.realm.JDBCRealm" debug="99"
                       driverName="org.gjt.mm.mysql.Driver"
                    connectionURL="jdbc:mysql://localhost/authority?user=test;password=test"
                        userTable="users" userNameCol="user_name" userCredCol="user_pass"
                    userRoleTable="user_roles" roleNameCol="role_name" />
                -->

                <!--
                <Realm  className="org.apache.catalina.realm.JDBCRealm" debug="99"
                       driverName="oracle.jdbc.driver.OracleDriver"
                    connectionURL="jdbc:oracle:thin:@ntserver:1521:ORCL?user=scott;password=tiger"
                        userTable="users" userNameCol="user_name" userCredCol="user_pass"
                    userRoleTable="user_roles" roleNameCol="role_name" />
                -->

                <!--
                <Realm  className="org.apache.catalina.realm.JDBCRealm" debug="99"
                       driverName="sun.jdbc.odbc.JdbcOdbcDriver"
                    connectionURL="jdbc:odbc:CATALINA"
                        userTable="users" userNameCol="user_name" userCredCol="user_pass"
                    userRoleTable="user_roles" roleNameCol="role_name" />
                -->

                <!-- default virtual host 설정하기 -->
                <Host name="localhost" debug="0" appBase="webapps" unpackWARs="true">

                  <!-- 보통, 사용자는 각각의 웹 어플리케이션에 인증을 해줘야만 합니다.
                       사용자가 security 제한에 걸려있는 보호된 자원 중에서 처음에 걸리는
                       인증을 한번만 통과하고, 이 가상호스트 안의 "모든" 웹어플리케이션에
                       통과된 인증으로 접근하게 하려면 아래 엔트리의 주석을 해제하십시오.
                  -->
                  <!--
                  <Valve className="org.apache.catalina.authenticator.SingleSignOn"
                             debug="0"/>
                  -->

                  <!-- Access log는 이 가상호스트에 접속하는 모든 요청을 처리합니다. 기본값은
                       로그 파일은 $CATALINA_HOME 에 상대적인 "logs" 디렉토리에 생성됩니다.
                       "directory" 속성을 이용해서 원하는 다른 디렉토리로 지정할 수 있습니다.
                       ($CATALINA_HOME 에 대해) 상대적인 디렉토리나 또는 원하는 디렉토리의
                       절대 경로를 써주면 됩니다.
                  -->
                  <Valve className="org.apache.catalina.valves.AccessLogValve"
                           directory="logs"  prefix="localhost_access_log." suffix=".txt"
                           pattern="common"/>

                  <!-- 이 가상 호스트에 관계된 모든 Context 에 의해 공유된 Logger. 기본값은
                       (FileLogger 를 사용할 때), 로그 파일들은 $CATALINA_HOME 에 상대적인
                       "logs" 디렉토리에 생성됩니다. "directory" 속성을 이용해서 원하는 다른
                       디렉토리로 지정할 수 있습니다. ($CATALINA_HOME 에 대해) 상대적인 디렉
                       토리나 또는 원하는 디렉토리의 절대 경로를 써주면 됩니다.
                  -->
                  <Logger className="org.apache.catalina.logger.FileLogger"
                           directory="logs"  prefix="localhost_log." suffix=".txt"
                      timestamp="true"/>

                  <!-- 각각의 웹 어플리케이션에 대한 프로퍼티 설정. 이것은 기본값과는 다른 프로
                       퍼티를 설정하기 윈할 때나, 웹어플리케이션 document 루트 디렉토리가 가상
                       호스트의 appBase 디렉토리와 다른 곳에 있을 경우에만 필요합니다.
                  -->

                  <!-- Tomcat Root Context -->
                  <!--
                    <Context path="" docBase="ROOT" debug="0"/>
                  -->

                  <!-- Tomcat Examples Context -->
                  <Context path="/examples" docBase="examples" debug="0"
                           reloadable="true">
                    <Logger className="org.apache.catalina.logger.FileLogger"
                               prefix="localhost_examples_log." suffix=".txt"
                        timestamp="true"/>
                    <Ejb   name="ejb/EmplRecord" type="Entity"
                           home="com.wombat.empl.EmployeeRecordHome"
                         remote="com.wombat.empl.EmployeeRecord"/>
                    <!-- PersistentManager: 영속적인 세션을 테스트 하기위해서는 아래
                         섹션의 주석을 지워주십시오.
                                  
                         saveOnRestart: true 값일 경우, Catalina 가 shutdown 될 때
                           모든 살아있는 세션들은 다른 세팅과는 상관없이, Store 에
                           저장될 것입니다. startup 할 때 Store 에 있는 모든 세션들
                           은 자동으로 로드됩니다. expiration 이 지난 세션들은 양쪽
                           의 경우에 무시됩니다.
                         maxActiveSessions: 0 이상의 값일 경우, 너무 많은 살아 있는 세
                           션이 있다면 몇몇은 없어져버리는 결과가 있을 수 있습니다.
                           minIdleSwap 은 이것을 제한합니다. -1 은 무한 세션을 허가한
                           다는 뜻입니다. 0 은 사용 후 세션은 거의 모두 없어져 버립니다
                           - 사용자들에게 인지될 정도로 느리게 될 것입니다.
                         minIdleSwap: 세션은 적어도 이기간 동안 idle 상태이어야 합니다.
                           (초 단위로) 없어지기 전에 말이죠.
                         maxActiveSessions. 이것은 사이트가 아주 활발할 때 thrashing 을
                           피하게 합니다. -1 이나 0 은 minimum 이 없다는 뜻입니다 - 세션
                           은 어느때라도 소멸될 수 있습니다.
                         maxIdleSwap: (초 단위로) 세션은 이 기간동안 idle 상태면 소멸됩
                           니다. minIdleSwap 이 보다 높다면, 그것으로 바꿔집니다.
                           이것은 정확하지 않습니다: 주기적으로 확인합니다.
                           -1 은 maxActiveSessions 값으로 인해 소멸되어야 해도, 세션은
                           소멸되지 않음을 의미합니다. 0 이상으로 세팅되면, startup 할 때
                           Store 에 있는 모든 세션은 로드될 것을 보장합니다.
                         maxIdleBackup: (Store 에 저장되었지만, active 메모리에 남아있는)
                           세션은 백업될 것입니다. 이 기간동안 idle 상태고, startup 할 때
                           Store 에 있는 모든 세션들이 로드될 것입니다. -1 로 설정되었다면
                           세션은 백업되지 않을 것이고, 0 은 사용된 뒤에 잠깐 백업된다는
                           것을 의미합니다.

                         Store 에 있는 세션을 지우려면, maxActiveSessions, maxIdleSwap,
                         minIdleBackup 모두를 -1 로, saveOnRestart 는 false로 세팅한 후,
                         Catalina 를 재시동합니다.
                    -->
                    <!--
                    <Manager className="org.apache.catalina.session.PersistentManager"
                        debug="0"
                        saveOnRestart="true"
                        maxActiveSessions="-1"
                        minIdleSwap="-1"
                        maxIdleSwap="-1"
                        maxIdleBackup="-1">
                          <Store className="org.apache.catalina.session.FileStore"/>
                    </Manager>
                    -->
                    <Environment name="maxExemptions" type="java.lang.Integer"
                                value="15"/>
                    <Parameter name="context.param.name" value="context.param.value"
                               override="false"/>
                    <Resource name="jdbc/EmployeeAppDb" auth="SERVLET"
                              type="javax.sql.DataSource"/>
                    <ResourceParams name="jdbc/TestDB">
                      <parameter><name>user</name><value>sa</value></parameter>
                      <parameter><name>password</name><value></value></parameter>
                      <parameter><name>driverClassName</name>
                        <value>org.hsql.jdbcDriver</value></parameter>
                      <parameter><name>driverName</name>
                        <value>jdbc:HypersonicSQL:database</value></parameter>
                    </ResourceParams>
                    <Resource name="mail/Session" auth="Container"
                              type="javax.mail.Session"/>
                    <ResourceParams name="mail/session">
                      <parameter>
                        <name>mail.smtp.host</name>
                        <value>localhost</value>
                      </parameter>
                    </ResourceParams>
                  </Context>

                </Host>

              </Engine>

            </Service>

            <!-- MOD_WEBAPP 커넥터는 apache 1.3 과 서블릿 컨테이너로 Tomcat 4.0 을 연결하는
                 데 쓰입니다. WebApp 모듈 배포판에 포함된 어떻게 만드는지에 대해 설명하는
                 README.txt 파일을 읽어보십시오. (또는 "jakarta-tomcat-connectors/webapp"
                 CVS repository 를 확인해 보십시오.)

                 Apache 쪽에서 설정하려면, 먼저 "httpd.conf" 에 설정되어진 "ServerName" 과
                 "Port" 지시자를 확인해야 합니다. 그리고, "httpd.conf" 파일 아래에 다음과
                 같은 줄을 넣어줍니다:

                   LoadModule webapp_module libexec/mod_webapp.so
                   WebAppConnection warpConnection warp localhost:8008
                   WebAppDeploy examples warpConnection /examples/

                 이 후에 (필요하다면 Tomcat 을 재시동한 후) Apache 를 재시작하면 연결이 됩니
                 다. Apache 를 통해서 "WebAppDeploy" 지시자에 있는 모든 어플리케이션들이 실
                 행하는 것을 보실 수 있습니다.
            -->

            <!-- Apache-Connector Service 설정하기 -->
            <Service name="Tomcat-Apache">

              <Connector className="org.apache.catalina.connector.warp.WarpConnector"
               port="8008" minProcessors="5" maxProcessors="75"
               enableLookups="true"
               acceptCount="10" debug="0"/>

              <!-- "localhost" 를 Apache "ServerName" 에 설정된 값으로 대치해주십시오 -->
              <Engine className="org.apache.catalina.connector.warp.WarpEngine"
               name="Apache" debug="0" appBase="webapps">

                <!-- 하위 레벨에서 설정되지 않았다면 Global logger -->
                <Logger className="org.apache.catalina.logger.FileLogger"
                        prefix="apache_log." suffix=".txt"
                        timestamp="true"/>

                <!-- 이 Realm 이 여기 있기 때문에, 전체적으로 이 Realm 이 공유됩니다. -->
                <Realm className="org.apache.catalina.realm.MemoryRealm" />

              </Engine>

            </Service>

          </Server>

2007/10/17 09:15 2007/10/17 09:15
트랙백 0개, 댓글 0개가 달렸습니다.

CentOS 5 최소 설치후 해야할것들

Centos 2007/10/04 09:24

## Centos 5.0 설치후 튜닝 ##
최소 설치

ftp설치
yum -y install vsftpd
rzsz 설치
yum -y install lrzsz

설치후 패키지 업데이트 및 설치
rpm -e man-pages-ko
yum -y rpm-build

ex) rpm -tb --target i686 proftpd-1.3.0kr.tar.bz2  -32bit
ex) rpm -tb --target x86_64 proftpd-1.3.0kr.tar.bz2  -64bit
Copywrite 오류 License로 변경한다. .spec파일

yum -y update
yum -y install gcc
yum -y install gcc-c++
yum -y install ncurses-devel
-----------------------------------php
yum -y install flex
yum -y install zlib-devel
yum -y install libjpeg-devel
yum -y install libpng-devel
yum -y install freetype-devel
yum -y install gd-devel

yum -y install vsftpd
한글문제
/etc/sysconfig/i18n 수정

LANG="ko_KR.eucKR"
SUPPORTED="ko_KR.eucKR:ko_KR:ko:en_US:en"
SYSFONT="lat0-sun16"
SYSFONTACM="iso01"

배쉬 쉘문제
/etc/bashrc
/etc/profile.d/ 전체 파일 수정

안녕 oops-firewell 설치
/etc/rc.d/init.d/iptables 삭제
/etc/sysconfig/iptables 삭제
yum -y install bridge-utils

서비스
#acpid - 전원관리 데몬
#anacron - 해당 작업 실행여부 체크후 실행(cron과 비슷하나 데탑용이라고 보면됨)
#atd - 특정 시간 또는 시스템 부하가 적을때 지정된 명령을 실행시키는 데몬
#auditd- ?
#autofs - Autofs는 자동 마운트 데몬(amd)의 작동을 제어하는 프로그램이다 자동마운트 데몬은 자동으로 파일
 시스템을 마운트하며 파일 시스템이 사용되지 않고 일정 시간이 흐르면 자동으로 언마운트 한다. 네
 트워크 파일 시스템, CD-ROM, 플로피 등을 마운트하는데 사용된다.
#bluetooth - ?
#cpuspeed - CPUSpeed for Linux adjusts the CPU speed dynamically based on the demand for processing power.
 Disable it unless you are using a laptop        
#cups - the Common UNIX Printing System 
#firstboot - 처음에 시작되는 드루이드 스타일의 프로그램
#gpm - gpm란, 마우스를 사용한 'cut- and-paste'를, X 상에서 가능한것처럼,
 Linux의 가상 단말기 사이에서도 가능하도록 하는 프로그램이다
#haldaemon - usb / cdrom 자동 마운트
#hidd - bluetooth 관련?

irqbalance - Multiprocessor(둘 이상의 CPU를 사용하는 환경)에서 CPU간의 Interrupt를 분리하기 위한 Daemon
#mcstrans - 사람이 읽기 쉬운 형식으로 보안 환경 정보로 번역하는 시스템. ( SELinux 환경에서... 사용 )
#mdmonitor - RAID상태를 모니터링하기 위한 데몬
messagebus - 시스템 이벤트를 전송하기 위한 데몬.
microcode_ctl - Intel cpu의 마이크로 코드 업데이트 데몬

#pcscd - PC/SC 스마트 카드 데몬이다. 뭐 스마트 카드를 사용하는 컴퓨터가 아니라면 정지하자~~!
#portmap - rpc (remote procedure call)에서 제공하는 포트맵퍼로 nfs, nis등 운영하기 위해 필요한 서비스로
                 nfs, nis 서비스를 제공하지 않는다면 정지하자~~!!
#readahead_early - 모든 데몬이 시작하기 전에 특정 파일을 사용하기에 앞서 메모리에 미리 불러들여 속도를
                             높이기 위한 데몬이다.
restorecond - SELinux 데몬과 관련된 서비스이다. 함부로 멈추지 말기를...ㅋ SELinux는 이 데몬을 필요로 한다.

#rpcgssd - 원격 인증을 위한 GSS(General Security Service) Daemon이다. (NFS version 4 Client를 위해 필요)
#rpcidmapd - 원격 이름 매핑을 위한 idmap (ID mapping) 데몬 (NFS version 4를 위해 필요하다.)


 

2007/10/04 09:24 2007/10/04 09:24
트랙백 0개, 댓글 0개가 달렸습니다.

방화벽 스크립트

Shell Script 2006/11/10 14:14
rc.firewall
=============================================================
=========================
#!/bin/bash

IPTABLES=/sbin/iptables

echo 1 >/proc/sys/net/ipv4/tcp_syncookies
echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $f
done
fi


$IPTABLES -F INPUT
$IPTABLES -F OUTPUT


$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT

$IPTABLES -A INPUT -m state --state INVALID -j DROP
$IPTABLES -A OUTPUT -m state --state INVALID -j DROP

$IPTABLES -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A INPUT -p tcp --dport 20:22 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 143 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 953 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT

$IPTABLES -A INPUT -p tcp -j DROP
$IPTABLES -A OUTPUT -p tcp --dport 6666:6667 -j DROP
2006/11/10 14:14 2006/11/10 14:14
트랙백 0개, 댓글 0개가 달렸습니다.

현재의 mysql 패스워드를 모를때 변경할수 있는 shell

Shell Script 2006/11/10 14:13
현재의 mysql 패스워드를 모를때 변경할수 있는 shell

=============================================================
==========================================
#!/bin/sh
echo "mysql 데몬을 중지 합니다"
pkill mysqld
sleep 4
echo "mysql 데몬을 시작 합니다"
/usr/local/mysql/bin/mysqld_safe --skip-grant &
sleep 4
echo " "
echo "mysql 패스워드를 변경합니다."
echo " "
echo "변경할 mysql root 패스워드를 입력하시오"
read newpassword
echo "use mysql;
update user set password=password('$newpassword') where user='root';
flush privileges;" > insert_query
echo " "
/usr/local/mysql/bin/mysql -u root < insert_query
rm -rf insert_query
echo "mysql 데몬을 중지 합니다"
pkill mysqld
sleep 4
echo "mysql 데몬을 시작 합니다"
/usr/local/mysql/bin/mysqld_safe &
sleep 4
echo " "
echo "mysql 패스워드가 $newpassword로 변경되었습니다"
echo " "
2006/11/10 14:13 2006/11/10 14:13
트랙백 0개, 댓글 0개가 달렸습니다.

mysql-5.0.18 버전에서 사용자 추가 스크립트.

Shell Script 2006/11/10 14:13
mysql-5.0.18 버전에서 사용자 추가 스크립트.

버전이 다른 경우는 mysql db의 db 테이블에서 필드 수를 확인하고
아래의 쿼리만 수정하면 된다.

('y'의 갯수가 필드 수와 동일 해야 함.)

"insert into db values('localhost','$db','$db_user','y','y','y','y','y','y','y','y','y','y','y'
,'y','y','y','y','y','y');"

=============================================================
==========================================
#!/bin/sh
echo "추가할 db명을 입력하고 엔터를 치세요."
read db
sleep 1
echo " "
echo "사용할 db user명을 입력하고 엔터를 치세요"
read db_user
sleep 1
echo " "
echo "$db_user계정에서 사용할 패스워드를 입력하고 엔터를 치세
요"
read passwd
sleep 1
echo " "
echo "create database $db;" >> query
echo "use mysql;" >> query
echo "insert into user (host,user,password) values('localhost','$db_user',password('$passwd'));" >> query
echo "insert into db values('localhost','$db','$db_user','y','y','y','y','y','y','y','y','y','y','y'
,'y','y','y','y','y','y');" >> query
echo "flush privileges" >> query
echo "mysql root계정의 패스워드를 입력 하세요."
sleep 1
echo "mysql root계정의 패스워드가 설정되어 있지 않다면, 그냥 엔
터를 치세요"
if /usr/local/mysql/bin/mysql -u root -p < query; then
echo " "
sleep 1
echo "mysql db 및 계정이 추가 완료되었습니다. 아래와 같이
접속을 하세요."
sleep 1
echo " "
echo "/usr/local/mysql/bin/mysql -u $db_user -p $db"
echo " "
else
echo " "
echo "DB 생성에 실패 하였습니다. ERROR 라인을 확인 하시
고 다시 시도하세요."
echo " "
fi
rm -rf query
2006/11/10 14:13 2006/11/10 14:13
트랙백 0개, 댓글 0개가 달렸습니다.
◀ 이전페이지 1 2 3 4 5 ... 32