Sander's Weblog » Apache

Ubuntu Packages for Perl Modules

Sander — Tue, 26 Jan 2010 19:48:20 +0000

The Apache HTTP Server perl-framework testsuite needs a number of Perl modules in order to run. You can install those through CPAN, but on some distributions these modules have been made available through the distro packaging scheme.

This is a quick-and-dirty list of Perl-related packages that need to be installed on a vanilla Ubuntu system in order to run the perl-framework:

Ubuntu Package	Perl Module	Remarks
libcrypt-ssleay-perl	Crypt::SSLeay
libdevel-corestack-perl	Devel::CoreStack
libdevel-symdump-perl	Devel::Symdump
libdigest-md5-perl	Digest::MD5	Part of the default load
liburi-perl	URI	Part of the default load
	Net::Cmd	Part of perl-modules package
	MIME::Base64	Part of perl package
libhtml-tagset-perl	HTML::Tagset	Default load
libhtml-parser-perl	HTML::Parser	Default load
libhtml-parser-perl	HTML::HeadParser	Default load
libwww-perl	LWP	Default load
libipc-run3-perl	IPC::Run3
libhttp-dav-perl	HTTP::DAV	Sucks in the following libxml-dom-perl libxml-perl libxml-regexp-perl
perl-doc	Perl documentation	Some files are used as content by some tests

Share this post:

How to Build Apache for Development

Sander — Sat, 07 Nov 2009 17:10:11 +0000

This is how I currently build Apache httpd for development and testing.

Pre-requisites:

The Apache Portable Runtime library. I use trunk from http://svn.apache.org/repos/asf/apr/apr/trunk
The Perl-Compatible Regular Expressions library, either your own build or through your operating system. If you’re on Linux, be sure to install the -dev package as well

Once these are in place, check out the Apache source code from http://svn.apache.org/repos/asf/httpd/httpd/trunk, cd into the checkout and run ./buildconf --with-apr=/path/to/apr/source-code. Then run configure:

./configure \ --prefix=/somewhere/convenient \ --enable-mods-shared=all \ --enable-maintainer-mode \ --with-apr=/where/you/put/it \ --enable-proxy=shared \ --enable-ssl=shared \ --enable-case-filter=shared \ --enable-case-filter-in=shared \ --enable-bucketeer=shared \ --enable-echo=shared \ --enable-mpms-shared=all

make and make install. This module complement is what will be exercised by the test harness. The build system will leave the last ./configure invocation in config.nice, and also install the latter under the build subdirectory when you make install. Isn’t that nice?

To run the test harness, check out http://svn.apache.org/repos/asf/httpd/test/framework/trunk. Underneath the checkout, find in Apache-Test/lib/Bundle/ApacheTest.pm a list of the Perl modules you need. A number of these will already be on your system. Get what you don’t have from CPAN or your package manager. Also, install HTTP::DAV and its dependencies which is not on the list but needed to exercise mod_dav. Then run:

perl Makefile.PL t/TEST -httpd /somewhere/convenient/bin/httpd -apxs /somewhere/convenient/bin/apxs

Note your skips and failures. Add Apache modules and Perl modules if you find the list above out of date. Then make your changes to Apache, rebuild and run t/TEST again. If your new build is in a different installation root, run make realclean in the framework and set it up again. When your changes to Apache (no longer) cause any tests to fail, propose the change to dev@httpd.apache.org. If you add new functionality, add new tests. That’s all. Easy.

Share this post:

ApacheCon US 2009 PGP Keysigning

Sander — Wed, 04 Nov 2009 20:38:40 +0000

We’ll be doing a PGP Keysigning Session at ApacheCon. If you would like to participate, check out http://wiki.apache.org/apachecon/PgpKeySigning and make sure to mail me your public key before the end of today, Wednesday.

Share this post:

My ApacheCon US 2009 Wishlist

Sander — Tue, 03 Nov 2009 20:07:14 +0000

Get Apache HTTP Server building again on Gump (which involves losing the dependency on the Apache Portable Runtime Utility library, which was folded into APR proper)
Get @pgollucci what he needs on clarus.apache.org, and work on the future of that box
Talk about Apache 2.4, and what is still needed to get that out the door. Then, maybe start talking about figuring out what 3.0 is going to be like
Prepare for the Keysigning — which may mean creating a new PGP key
Prepare for my presentation on Thursday
Do some httpd hacking. Perhaps pull in the ECC patch that has been sitting in Bugzilla

Web Hacking Incident Database Report

Sander — Wed, 19 Aug 2009 04:12:32 +0000

The The Web Hacking Incidents Database 2009: Bi-Annual Report is out. If I recall correctly, the first report Breach did, in 2007, did not mention any bi-annualness. Also, the eventual landing page has as HTML title “The Web Hacking Incidents Database 2008: Annual Report”. Is it possible that they simply didn’t get their act together last year and retroactively declared the report bi-annual?

I went in through the link above, gave up my e-mail, phone number and name of my first born, and downloaded the report. This will probably land me another copy of every marketing e-mail Breach sends out (guess how I learned of this report?), and a phone call from some poor guy in a cube who has to make 75 phone calls a day for a living. Oops, guess I put down a fax number. Sorry dude, hope your headset isn’t too loud.

Anyway, after you go though the lead generation form you land here and can follow a direct link to the PDF. This is fairly standard practice, but from a security company I would expect that they would make some more effort to not inadvertedly expose the goods.

I will give this report a read, and probably discuss it in my upcoming talk at ApacheCon US 2009. Oh, they just extended the early bird registration deadline… without changing their own website to tell you about it. Register now and experience the mayhem.

Share this post:

My First Apache E-mail

Sander — Sun, 29 Mar 2009 01:53:39 +0000

Looks like this was my first message to an Apache mailinglist: a suggestion on how to build a recently enhanced ApacheBench on systems that (unlike Mac OS X) don’t have the Math library linked in together with the C library (or libSystem.dylib, as the case may be).

Share this post:

Ctrl-Alt-What?

Sander — Thu, 18 Dec 2008 22:51:42 +0000

I run a VMWare Server 2.0 installation so I can test Apache and other things on a wide variety of operating systems. Recently, I’ve been fighting to send Ctrl-Alt-Delete to the remote console of a VM from my Ubuntu workstation… some operating systems work better with Ctrl-Alt-Delete, but the moment you press Ctrl-Alt the console releases input focus. On a Windows client, you use Ctrl-Alt-Insert because the local operating system will catch the real thing.

It turns out you are to press the Del key on the numeric keypad, not on your main keyboard, to send the key combo to the console. I’m blogging this so the LazyWeb learns of it, and when next I forget I can Google for my own post.

VMWare Server rocks: the price is more than right, which allows me to do my Open Source work without paying Closed Source prices. And that in turn benefits VMWare because some of their stuff is clearly based on Apache Software Foundation projects.

Share this post:

Hardening Apache Presentation Book List

Sander — Wed, 19 Nov 2008 03:04:34 +0000

At the end of my Hardening Enterprise Apache Installations Against Attacks presentation at ApacheCon US 2008 I had a slide of interesting reading material. Here are the books on the list, and links to some of the articles:

I also included links to some interesting articles and organizations. Most of these were visited early November 2008:

The Apache HTTP Server Security Report
The Center for Internet Security who publish benchmarks for web server and operating system security
The Open Web Application Security Foundation concentrates on developing secure web application code
The Web Application Security Consortium
The National Institute for Standards and Technology (NIST) published a checklist for securing internet-facing web servers

Share this post:

Security Roadmap for ApacheCon US 2008

Sander — Wed, 05 Nov 2008 16:13:20 +0000

At the end of my conference presentations, I usually put a Conference Roadmap slide. This slide shows sessions at the conference that are related to mine, and that attendees may find worth while to check out. For my Hardening Enterprise Apache Installations session this coming Thursday, I would suggest the following related conference content:

Training: Web Application Security Bootcamp by Christian Wenz
Thursday, 9AM: Hardening Enterprise Apache Installations Against Attacks by yours truly
Thursday, 10AM: Web Intrusion Detection with ModSecurity by Ivan Ristic
Thursday, 2PM: (In)secure Ajax and Web 2.0 Web Sites by Christian Wenz
Thursday, 3PM: Geronimo Security, now and in the future by David Jencks
Thursday, 4:30PM: Securing Apache Tomcat for your Environment by Mark Thomas
Thursday, 5:30PM: Securing Communications with your Apache HTTP Server by Lars Eilebrecht

Besides the training (which happened on Monday), this means that you can pretty much stay in the same room all Thursday and catch all the Security-related talks. In addition, of course, this track will be streamed live for a modest fee, so you can watch from the comfort of your own office if you find yourself unable to make it to ApacheCon this year.

Share this post:

Celebrating Obama Victory

Sander — Wed, 05 Nov 2008 07:02:03 +0000

This is the Next Generation Brass Band in New Orleans, celebrating Barack Obama’s presidential election victory on the corner of Bourbon Street in New Orleans.

This was more fun than all the Bourbon Street craziness combined.

Share this post: