Home / user-400607

MarkHelms's questions

Martin Hope
MarkHelms
Asked: 2020-08-09 05:46:24 +0800 CST
  • 0

I have a fresh installation of CentOS 8. I installed Apache 2.4.37 from the repo. Then installed the latest ModSecurity:

dnf install mod_security -y

Checked the installation

dnf info mod_security

Result:

Name         : mod_security
Version      : 2.9.2

The required Apache modules are available / loaded:

apachectl -M | grep security -> security2_module (shared)
apachectl -M | grep unique -> unique_id_module (shared)

Installed the core rule set from the repo:

dnf install mod_security_crs

which automatically links the rules into the apache folder

/etc/httpd/modsecurity.d/activated_rules

Rules have been checked / are at place.

The main config file

/etc/httpd/conf.d/mod_security.conf

includes necessary further config files, including the rules conf files themselves:

IncludeOptional /etc/httpd/modsecurity.d/crs-setup.conf
IncludeOptional /etc/httpd/modsecurity.d/activated_rules/*.conf
IncludeOptional /etc/httpd/modsecurity.d/local_rules/*.conf

(paths have been double-checked) and activates the rules engine:

SecRuleEngine On

The rules config file modsecurity.d/crs-setup.conf (which is included in mod_security.conf, see above) provides

SecDefaultAction "phase:1,log,auditlog,deny,status:403"
SecDefaultAction "phase:2,log,auditlog,deny,status:403"

Apache httpd.conf calls ModSecurity:

SecStatusEngine On

A restart (apachectl restart) shows that ModSecurity was loaded successfully:

ModSecurity: StatusEngine call successfully sent. <-- including LUA etc.

Tests with manipulated URLs like a script insert:

/?q=%22%3E%3Cscript%3Ealert(1)%3C/script%3E%27

show no reaction whatsoever on ModSecurity's side. No entries at all in ModSecuritie's audit and debug log files (debug level was set to 3), no errors in Apache's log files.

centos mod-security
Martin Hope
MarkHelms
Asked: 2018-07-13 00:10:16 +0800 CST
  • 2

Webserver: Apache 2.4 on SuSE 12, multiple vhosts

4 vhosts (2 ssl, 2 http) have RewriteEngine on and some simple rewrite rules.

mod_rewrite is available and active (checked with a2enmod -l)

Problem: if I issued a httpd -t to check the syntax, I received for the two http vhosts a warning: 

AH00526: Syntax error Invalid command 'RewriteEngine', perhaps misspelled
or defined by a module not included in the server configuration

After having added <IfModule mod_rewrite.c> ... </IfModule> lines around the rewrite blocks the warning disappeared.

Question: Why is there no warning with respect to the two ssl vhosts, which also have the RewriteEngine on, but no enclosing IfModule lines?

apache-2.4
Martin Hope
MarkHelms
Asked: 2018-02-22 02:26:09 +0800 CST
  • 0

We have added two CA certificates - 1 root CA and 1 associated intermediate CA - into the according OS trust store (/etc/ssl/certs on our SuSE 11), because they weren't provided by the OS'es trust store (and probably will never, since tey are not in the repo).

Recently these two certificates disappeared after an auto-update, with the obvious effect that clients weren't able to connect via tls any longer.

In hindsight we are not sure if we did the usual rehash of the entries, i.e.

    # c_rehash /etc/ssl/certs

IF we did not do the rehash: Would this have been the reason for the deletion of the according certificates during the update?

Or is there always a risk of loosing certificates if they are added to the trust store by hand (on the system in question are two ssl libraries: openssl and mozilla-nss) ?

ssl
Martin Hope
MarkHelms
Asked: 2018-01-31 06:12:49 +0800 CST
  • 0

For many of our openssh servers we have their fingerprints in DNS (SSHFP). We do not yet use secure DNS, i.e. though the FP is in DNS, a connect like

    ssh -o VerifyHostKeyDNS=yes <user>@sshserver

will be answered like

    Matching host key fingerprint found in DNS.

and unfortunately, but in full accordance with man man ssh 

    Host key verification failed.

Since we have many external clients who come across this message it often invokes confusion and questions. Is there a way to change these messages?

domain-name-system
Martin Hope
MarkHelms
Asked: 2017-08-30 23:12:53 +0800 CST
  • 1

Goal:

Maintaining a former colleagues system, I want to lock all password logins in order to only allow ssh key based logins.

Infos:

  • The CentOS 6.5 system does not offer any network based authentication features (no Kerberos, ldap, gssapi etc., /etc/nsswitch.conf knows only "files").

  • /etc/passwd shows all non-system users I expect.

Issue:

/etc/shadow shows only half of them. Locking their passwords with passwd -l username worked. Now I would like to see entries for the other users as well and that their passwords are locked, too.

Trial:

did a passwd -l username for one of the "missing" users, and the system gives me passwd: Success . But I still see no entry for this user in shadow. Any ideas?

ssh
Martin Hope
MarkHelms
Asked: 2017-08-26 06:59:10 +0800 CST
  • 0

OS: CentOS 6.5 SSH v5.3

Goal:

  • root access is allowed with PubKeyAuthentication from several hosts.

  • users of "group1" are allowed to login with whatever they provide: PubKey, Password, GSSAPI, KerberosPassword; but they are only allowed to arrive from one certain IP: 192.168.1.10

Status: root access is already defined via multiple from="" -entries in ~/.ssh/authorized_keys, and works as expected.

Problem: users of group1 can arrive from 192.168.1.10 OR from elsewhere; or are locked out completely (with earlier tested configurations).

I tried several variations, but to no avail.

/etc/pam.d/sshd effectively looks like:

    auth        sufficient    pam_unix.so nullok try_first_pass
    auth        requisite     pam_succeed_if.so uid >= 500 quiet

Currently I have in sshd_config :

    PermitRootLogin without-password
    PasswordAuthentication no
    KerberosAuthentication no
    GSSAPIAuthentication no
    UsePAM yes

    AllowGroups root group1

    Match Group [email protected]
        KerberosAuthentication yes
        PasswordAuthentication yes
        GSSAPIAuthentication yes
        PubKeyAuthentication yes
    Match Group root
        PubKeyAuthentication yes

Any proposals?

ssh
Martin Hope
MarkHelms
Asked: 2017-07-04 01:25:25 +0800 CST
  • 0

We want to protect our VMWare vsphere 6.5 web client with an already existing & working Apache 2.4 reverse proxy (benefits e.g. centralised monitoring, mod_security et.al.)

Both communications client <--> proxy, and proxy <--> backend (= vsphere) must be be TLS secured. Certificates are in place and ok. DNS is configured accordingly.

Clients can already access the vsphere start page via proxy successfully e.g. https:// vsphere.domain.tld/

Firefox' network analyses shows that all request are fine and accepted, e.g.

    302 GET /vsphere-client/ [FQDN] document html

until /vsphere-client/UI.swf

But as soon as a user clicks on the link "vSphere Web Client (Flash)" in order to authenticate and enter the menues, a status code 400 is thrown. The "vSphere Web Client (Flash)" link directs to /vsphere-client/ and obviously invokes a SAML request.

    400 GET https://vsphere.domain.tld/websso/SAML2/SSO/vsphere.local?SAMLRequest=zVRba9sw[...] [FQDN] subdocument

vsphere sso log shows:

    tomcat-http--38 ERROR org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder] SAML message intended destination endpoint 'https://vsphere-internal.domain.tld/websso/SAML2/SSO/vsphere.local' did not match the recipient endpoint 'https://vsphere.domain.tld/websso/SAML2/SSO/vsphere.local'

Virtual host conf on Apache reverse proxy so far (excerpt) :

    SSLProxyEngine on
    ProxyPreserveHost on
    ProxyRequests off
    ProxyPass        / https://vsphere.domain.tld/
    ProxyPassReverse / https://vsphere.domain.tld/

    ProxyPass        /vsphere-client https://vsphere.domain.tld/vsphere-client/
    ProxyPassReverse /vsphere-client https://vsphere.domain.tld/vsphere-client/
    ProxyPass        /websso/SAML2/SSO https://vsphere.domain.tld/websso/SAML2/SSO/
    ProxyPassReverse /websso/SAML2/SSO https://vsphere.domain.tld/websso/SAML2/SSO/

    # new, to solve the name binding problem (see 1st answer)
    RequestHeader set Host "vsphere-internal.domain.tld"

With the last "RequestHeader" addendum - which in effect just reverses the PreserveHost option - I am now able to see the vsphere login page, and to log in, but the page then stucks again:

    tomcat-http--10 ERROR com.vmware.identity.BaseSsoController] Could not parse tenant request java.lang.IllegalStateException: org.opensaml.xml.security.SecurityException: SAML message intended destination endpoint did not match recipient endpoint

Any proposals how to get the full page?

apache-2.4