Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of apache-lists@riggs.me
 designates 66.128.242.154 as permitted sender)
Content-Type: text/plain; charset=iso-8859-1
Mime-Version: 1.0 (Apple Message framework v1278)
Subject: Re: [PATCH] mod_log_forensic security considerations
From: Jim Riggs <apache-lists@riggs.me>
In-Reply-To: <201206072211.14168.sf@sfritsch.de>
Date: Thu, 7 Jun 2012 16:20:51 -0500
Content-Transfer-Encoding: quoted-printable
Message-Id: <33F5045A-D29A-49A1-8549-130BE7C4D2B8@riggs.me>
References: <20120529173642.GB16642@tarsus.local2>
 <CAKUrXK64uXNrmeiQ8aaHV4CRfVTv+Jk9yfWuTM-DA6kzUrLnVw@mail.gmail.com>
 <CALK=YjPv5emuRyRtRrSPzvqz4FPGLPD=AhaLOsNb_bE7CHMx_Q@mail.gmail.com>
 <201206072211.14168.sf@sfritsch.de>
To: dev@httpd.apache.org

On Jun 7, 2012, at 3:11 PM, Stefan Fritsch wrote:

> I share Williams concern that this makes mod_forensic potentially less=20=

> useful.
>=20
> Maybe making the forensic log mode 600 by default would be a better=20
> idea?


I have to agree with Jeff. I would rather have a more difficult or even =
impossible time debugging a crash than have a security hole that relies =
solely on file permissions.

Maybe it should be a toggle in mod_forensic for debugging purposes =
(defaulting to hiding Authorization). The problem with just changing the =
file permissions is that sensitive data is still stored in the files. =
Even if the files are owned by root, anyone with root access would have =
access to others' usernames and passwords. I don't want to have that =
access to others' credentials, nor do I want them to have access to =
mine.

I applied Jeff's patch as soon as it came across, wiped out all of our =
archived forensic logs, and had all of our affected users reset their =
passwords. Thanks, Jeff!

- Jim