Michael's questions

According to http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#x-headers, the X-Forwarded-Host can contain more than one value:

Be careful when using these headers on the origin server, since they will contain more than one (comma-separated) value if the original request already contained one of these headers

Can REMOTE_HOST contain more than one value? Or it always be the single value?

I need to set cache control headers for index.htm files Unfortunately the following configuration does not work. The reason when the user access “/” in a browser the server response with index.htm even it does not appear in the request.

<filesMatch "(index.htm)$">
  <ifModule mod_headers.c>
      Header set Cache-Control "max-age=0, no-cache, no-store, must-revalidate"
      Header set Pragma "no-cache"
      Header set Expires 0
  </ifModule>
</filesMatch>

How can I set cache control cookies?

We use Apache HTTPD server version 2.2 I need to redirect URLs in apache based on query parameters. Is it possible to redirect URLs without RewriteEngine?

We use Apache HTTPD server version 2.2. I want to create a filter that will be invoked once after the authentication. May be I missed but I can not find it here: http://httpd.apache.org/docs/2.2/mod/mod_filter.html

Added

We use Apache for the authentication (http://httpd.apache.org/docs/2.2/mod/mod_auth_basic.html)

May be we should create our own authorization module (http://httpd.apache.org/docs/2.2/mod/mod_authz_user.html)?

I have Apache HTTPD server in our product and I need to add the AJP proxy to some specific application.

The Tomcat AJP port is 8009 and the Tomcat HTTP port is 8080 (the SSL termination is in Apache). This is the AJP proxy I need to configure.

<Directory /app>
    AuthType None
    Allow from all
    Satisfy any
    AllowOverride None
    Options None FollowSymLinks
</Directory>

<Proxy http://localhost:8080/app >
    AuthType None
    Allow from all
    Order Deny,Allow
    Satisfy any
    Options None FollowSymLinks
</Proxy>
ProxyPass /app ajp://localhost:8009/app
<Location /app>
        ProxyPassReverse ajp://localhost:8009/app
</Location>

Question: What should be configured in <Proxy … >? <Proxy http://localhost:8080/app > or <Proxy ajp://localhost:8009/app >

Added Clarification. The whole configuration contains the root configuration (see below).

I just need to add AJP proxy to some specific application.

<Directory />
    Deny from all
    Allow from localhost
    Order Deny,Allow
    AuthType Basic
    Require valid-user
    AllowOverride None
    Satisfy any
    Options None FollowSymLinks
</Directory>


<Proxy *>
    Deny from all
    Order Deny,Allow
    AuthType Basic
    Require valid-user
    Satisfy any
    Options None FollowSymLinks
</Proxy>

This is the configuration:

<Directory />
    Deny from all
    Allow from localhost
    Order Deny,Allow
    AuthType Basic
    Require valid-user
    AllowOverride None
    Satisfy any
    Options None FollowSymLinks
</Directory>


<Proxy *>
    Deny from all
    Order Deny,Allow
    AuthType Basic
    Require valid-user
    Satisfy any
    Options None FollowSymLinks
</Proxy>

Questions:

1) Why configured Proxy * if already configured Directory /?

2) Should be configured Proxy * or Proxy /

3) Should all attributes (e.g. Deny from all or Allow from localhost) be configured twice (Proxy and Directory) or enough only in one place? If in one place where it should configured: Proxy or Directory?

4) What configuration takes priority Proxy or Directory?

Added Is order of Directory / Proxy in the configuration file is important? For example if I have specific /app related section should it be before or after the root section?

<Directory /app>
    AuthType None 
</Directory>

<Proxy http://localhost:8080/app >
    AuthType None
</Proxy>

I use OpenSwan IPSec tunnel on CentOS 6.7.

I have added the following configuration in /etc/ipsec.secrets according to this link: http://linux.die.net/man/5/ipsec.conf

config setup

plutodebug=all

plutostderrlog=/var/log/openswan.log

Unfortunately I can not see logs in openswan.log.

What I have missed?

My web application run on Centos6. I want to protect my application. I want to ensure that HTTP request with some specific header come only from a specific IP only.

(The header include a user name and I want to prevent HTTP header spoofing).

Important clarification: Requests without the specific header should be allowed from any IPs

Is it possible to do it with IPTable? Other options?

(Please do not close it. It is not duplicate of SSLCipherSuite - disable weak encryption, cbc cipher and md5 based algorithm)

I use Apache 2.2. I have started to get the following message from the scanner:

Configure SSL/TLS servers to only use TLS 1.1 or TLS 1.2 if supported.
Configure SSL/TLS servers to only support cipher suites that do not use block ciphers. Apply patches if available.

Unfortunately I can not use TLS 1.1 version ( I plan to do it only in the next major version).

I want to block CBC ciphers but I did not success to do it.

I configured the following ciphers but it did not help:

SSLCipherSuite HIGH:!ADH:!MD5:-EDH-RSA-DES-CBC3-SHA:-EDH-DSS-DES-CBC3-SHA:-DES-CBC3-SHA

How to prevent CBC ciphers while using TLS 1.0 in Apache?

Added

I have tested my environment with TestSSLServer as recommended at OWASP: https://www.owasp.org/index.php/Testing_for_Weak_SSL/TLS_Ciphers,_Insufficient_Transport_Layer_Protection_%28OTG-CRYPST-001%29

I get the following output:

Supported versions: TLSv1.0
Deflate compression: no
Supported cipher suites (ORDER IS NOT SIGNIFICANT):
  TLSv1.0
     RSA_WITH_3DES_EDE_CBC_SHA
     DHE_RSA_WITH_3DES_EDE_CBC_SHA
     RSA_WITH_AES_128_CBC_SHA
     DHE_RSA_WITH_AES_128_CBC_SHA
     RSA_WITH_AES_256_CBC_SHA
     DHE_RSA_WITH_AES_256_CBC_SHA
     RSA_WITH_CAMELLIA_128_CBC_SHA
     DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
     RSA_WITH_CAMELLIA_256_CBC_SHA
     DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
     TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
     TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

I can see only CBC ciphers!

Is it possible to prevent CBC ciphers while using TLS 1.0 in Apache?

In our deployment we have two servers. I want to connect it via host to host VPN: Host-To-Host VPN Using Openswan

On one server we have JMS broker on the second server we have JMS client and I want allow access to JMS broker only if it is pass via IPSec channel (JMS broker and client is only for the example).

Is it possible to check that packets pass via IPSec channel?

Is possible to use Pacemaker failover without hardware?

1. On quickstart http://clusterlabs.org/quickstart-redhat.html you can find the followowing commands: ccs -f /etc/cluster/cluster.conf --addfencedev pcmk agent=fence_pcmk

2. Similar here: http://clusterlabs.org/quickstart-ubuntu.html <fencedevice name="pcmk" agent="fence_pcmk"/>

What is fence device? Is it hardware?

Added

According to the answer below, it is not possible to implement fencing without hardware. We want to use failover, but we do not want to use power card or something like this. Is it possible to implement failover without without fencing?

Alternatively, can we use as a fencing device the UDP / TCP connections?

We have the following configuration:

<Directory /docs>
    AuthFormAuthoritative Off
    AuthType None
    Allow from all
    Satisfy any
    Options FollowSymLinks
</Directory>

Problem: I do not want any cookie will be send to the Apache directory with documents (URLs started with /docs) even a user visit first a main site that requires the authentication.

Is it possible to do with Apache? What configuration should I add?

We had only one VirtualHost in our Apache 2.2 server configuration:

<VirtualHost _default_:443>

Our customers want be able to put in the browser only the server name in HTTP (e.g. 10.10.0.1) and the sever will redirect automatically to HTTPS. So, we required to add the one addition VirtualHost and to configure redirection to HTTP using RewriteEngine:

<VirtualHost *:80>
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteCond %{REMOTE_HOST} !^127\.0\.0\.1.*$
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</VirtualHost>

Question: Is it possible to configure transport CONFIDENTIAL in Apache HTTPD server? We want to found configuration similar to the following configuration of web.xml:

<transport-guarantee>CONFIDENTIAL</transport-guarantee>

Added

Our requirement: we want be sure for 100 percent that even we opened port 80 for HTTP connection (that allows non encrypted connection) no data can be send or received from port 80. In Java (see the Java definition below) if CONFIDENTIAL is configured and a server configured both encrypted and not encrypted connections (HTTP and HTTPS) only HTTPS is used.

We want to find the similar configuration / Apache module that allow similar configuration.

From http://docs.oracle.com/javaee/5/tutorial/doc/bnbxw.html: Specify CONFIDENTIAL when the application requires that data be transmitted so as to prevent other entities from observing the contents of the transmission.

We use Apache 2.2 for authentication against Active Directory. The configuration is following:

AuthFormLDAPURL "ldap://*.*.*.*:389/DC=domain,DC=com?userPrincipalName,sAMAccountName?sub?(objectClass=*)"

Note: All traces below using WireShark.

I defined the user john when the CN is equal to the sAMAcountMame name:

I can authenticate using only john (sAMAcountMame). Please find below LDAP bind request:

LDAP bind response:

Then I defined the user johnd when the CN is NOT equal to the sAMAcountMame name:

Unfortunately, I can not authenticate using johnd (sAMAcountMame). Please find below LDAP bind request:

LDAP bind response:

I can authenticate using a full name [email protected]. Please find below LDAP bind request:

LDAP bind response:

Questions:

1. Why I can not authenticate using sAMAcountMame when the CN is NOT equal to the sAMAcountMame?
2. Why I can authenticate using sAMAcountMame at domain in this case?
3. Should we recommend to our users always to authenticate using sAMAcountMame at domain to prevent the authentication problems?

Thanks for your help!

I can not find how to see objects attributes in Active Directory in Microsoft Management Console (MMS). Please tell me if it is possible to do it in MMS. I found the Active Directory Explorer that show objects attributes: http://technet.microsoft.com/en-us/sysinternals/bb963907.aspx. Do you know better tools?

Added After the first answer

I want to find a simple UI tool that allow browse objects attributes in Active Directory like using Active Directory Explorer:

If you know LDAP browser that is better that Active Directory Explorer please let me know.

Does the attribute userPrincipalName (UPN) always exist for users in Active Directory? Can you specify the Active Directory versions where it is not created during creation of a user?