Entries Tagged as 'Apache'

mod_cfml 1.1 is released! Fast, reliable, and new features!

For those of you familiar with the mod_cfml project, you know it consists of two separate sections: The web server adapter that provides information about the web site being served, and the Tomcat valve, which takes that information and automatically processes it within Tomcat - creating a new host, alias, etc as needed within Tomcat so that Tomcat will match the information coming from the web server. Both the web server adapter and the Tomcat valve have been greatly enhanced in version mod_cfml version 1.1.

New features in The Tomcat valve:

  • Speed: the process of creating a new host in Tomcat has been greatly reduced and has taken less than a second in all our tests - down from several seconds in previous versions of mod_cfml. Jar scanning is disabled by default.
     
  • Speed: the process of "waiting for context files" has been completely removed as it is no longer necessary.
     
  • Speed and memory footprint: only one Tomcat “Host container” is created per Apache/IIS virtualhost/context. All aliases / default site hosts / IP-based hosts, are now added as aliases. The process of creating a new alias is lightning fast.
     
  • Bugfix: Thread safety errors have been corrected, and hosts are now created reliably in every event.

 

Next, for the web server adapter, for Apache 2.4 the web server adapter has been completely re-written in C! This means that any system can run mod_cfml natively without the need for mod_perl. The mod_perl version of mod_cfml will still be available for Apache 2.2, but will no longer be maintained. With Apache 2.4 and a native C-module, mod_cfml can run natively on any system with extreme speed and only a few lines of config!

The new mod_cfml.so also includes the following enhancements:

  • Feature: SES URL support is now handled automatically using path_into. Previously, URLs like /some/page.cfm/id/123 would not work out of the box with Tomcat. With mod_cfml 1.1, now they do! This feature is supported in Lucee, OpenBD, and Railo.
     
  • Security: A shared secret key implementation has been added to prevent unauthorized context creation.
     
  • Feature: Virtual directories, or “Aliases” in Apache, are now passed by default from the mod_cfml.so file and handled automatically by Lucee for the current request. Check the documentation for more details on this.

 

Documenation for mod_cfml 1.1 is HERE.

Installation instructions for mod_cfml 1.1 is HERE.

 

Huge "Thank you!" to Paul Klinkenberg and Bilal Soylu for their amazing dedication to this project. You two are awesome!

 

So... what are you waiting for? Install! Upgrade! Stay secure and have fun with CFML!

How to disable TLSv1.0 for PCI Compliance in Apache 2.2

Just recently our PCI compliance scanner started complaining about TLSv1.0 being enabled on our web server, so I had to go figure out how to disable it. The following is what I ended up with in our VirtualHost config which did what I wanted it to:
 
<VirtualHost xx.xx.xx.xx:443>
        ::snip::
        SSLEngine on
        SSLProtocol +TLSv1.1 +TLSv1.2
        SSLCompression off
        SSLHonorCipherOrder On
        SSLCipherSuite ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:HIGH:!MD5:!aNULL:!EDH
        Header always append X-Frame-Options SAMEORIGIN
        ::snip::
</VirtualHost>

PCI Compliance TLSv1.0I simply removed the "all" option I had there previously and just manually enabled the TLSv1.1 and TLSv1.2. I also added the "Header" bit so that common browsers wouln't put our site in frames.

Now, checking our SSL certificate using the SSL Server Test we get an A rating. The downgrade from A+ being due to an upstream older SHA1 hash that we have no way to change and doesn't directly effect the security of our site, so as far as I'm concerned we look good.

The draw back is that older machines, such as those running Windows XP and versions of Android older than 4.2.2 will no longer be able to connect to us. Sorry about that. Since this is required for PCI compliance, there's not much we can do.

Fixing "JRun too busy or out of memory" for PCI compliance

One of our servers here at Vivio is routinely scanned for PCI compliance purposes. Until just recently, we've been using FuseGuard (A Web Application Firewal, or "WAF"), to block intrusion attempts to our web application. With new PCI standards that force us to allow PCI scans through our WAF (or IDS or whatever), we had to allow these requests through, but that brought to light another, different, problem.

During the PCI scan, our Apache logs would get a lot of the following error messages:

[notice] jrApache[13857: 62679]  returning error page for JRun too busy or out of memory

Initially we thought that since the message was coming from the JRun connector, that the issue had something to do with the connector. However, after quite a bit more research, we found it had to do with JRun itself, and the specific number of post parameters it's configured to accept. Any more then the default "100" post parameters, and you'll get the error you see above.

To change the number of post parameters, you will need to update your neo-runtime.xml file. For our case, ours was found here:

/opt/coldfusion9/lib/neo-runtime.xml
NEO XML Example

IMPORTANT: Editing this file isn't particularly easy. Opening it in VIM gives you a big wall of text.

By increasing the following parameter from 100 to 300, we were able to succesfully complete our PCI scan:

<var name='postParametersLimit'><number>300.0</number></var>

Hopefully this helps anyone else having this issue.

Railo CGI remote_addr/remote_host says 127.0.0.1

When installed on to a Linux/Apache machine, the Railo installers will install mod_proxy_http as the default connector for Apache to Tomcat/Railo. The result is the same as you'd get with any other proxy, where the remote host is replaced with the address of the proxy (in this case 127.0.0.1) and the original requester's IP address is placed in the "X-Forward-For" header.

simplicityIf you need to find the original requestors IP address you can accomplish this in one of two easy ways.

Pull the IP from the X-Forward-For Header
This can be done easily using the following single line of code:

GetHttpRequestData().headers['X-Forwarded-For']

Use the Tomcat Remote IP Valve
This can be done simply by opening up your Tomcat server.xml file and adding a single line of code right under your "<Engine>" tag:

Change this:

<Engine name="Catalina" defaultHost="127.0.0.1">

To this:

<Engine name="Catalina" defaultHost="127.0.0.1">
<Valve className="org.apache.catalina.valves.RemoteIpValve" />

Restart Tomcat and you'll now see the IP address of the original requesting client populate your CGI scopes.

Apache 2.4 - 403 Forbidden (AH01630: client denied by server configuration)

I recently updated one of my development machines to Ubuntu 13.10 which now uses Apache 2.4 by default. In my case, I had updated a machine that was previously running Ubuntu version 13.04 and had been running Apache 2.2.

Apache 2.4After the upgrade, I was disturbed to find that none of my sites worked! I kept getting Apache 403 (Forbidden) error messages. I figured the upgrade had changed my configurations or something... but after fruitlessly messing with the config files (and seeing nothing wrong with them) I figured I'd look in the apache error log, which is located in /var/log/apache2/error.log by default on Ubuntu 13.10. To my surprise, I found lots of the following errors:

AH01630: client denied by server configuration: /path/to/my/sites

I had never seen that before. Then I noticed at the top of the log file "AH00163: Apache/2.4.6 (Ubuntu)". Ohhhhh....  So we're using the new 2.4 eh? After some google searches, I found out that Apache 2.4 comes with some security enhancements that attempt to make it more difficult for hackers to hide their files on a compromised system. That's neat, but I need to get my sites to work.

After reading a bit of the 2.4 Access Control Documentation, I found that a quick easy fix is to add a directory rule to your main apache config file (/etc/apache2/apache2.conf by default on Ubuntu):

<Directory /path/to/my/sites>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

Restart Apache, and boom, all sites are now loading just fine. The idea behind these rules is to make it so that hackers who, say, use SQL injection to access your PHP site, have a harder time hiding their files in obscure directories on your system, amond other things.

Hope this helps!
Jordan