Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: neutral (nike.apache.org: 76.96.62.24 is neither permitted nor
 denied by domain of jim@jagunet.com)
Content-Type: text/plain; charset=iso-8859-1
Mime-Version: 1.0 (Mac OS X Mail 6.0 \(1486\))
Subject: Re: how to avoid balancer manager nonce?
From: Jim Jagielski <jim@jaguNET.com>
In-Reply-To: <1568310F-EA79-479B-9F69-1AEB22C04223@jaguNET.com>
Date: Wed, 5 Sep 2012 06:57:51 -0400
Content-Transfer-Encoding: 7bit
Message-Id: <805F5E25-B275-408B-851C-8F42205A31D3@jaguNET.com>
References: 
 <CALK=YjNnOA25jbe9RHyMzx4r4e_HpaHitb2OG=vkGtcqCUQ0Xw@mail.gmail.com>
 <201208312014.57302.sf@sfritsch.de>
 <1568310F-EA79-479B-9F69-1AEB22C04223@jaguNET.com>
To: dev@httpd.apache.org

FWIW, I have time this week to impl this...

Feedback/Concerns?

On Sep 1, 2012, at 11:47 AM, Jim Jagielski <jim@jaguNET.com> wrote:

> Another alternative would be to have the nonce also possibly
> set at config-time and, if unset, then use the uuid. That way
> it could also be used as a sort of shared-secret ;)
> 
> 	ProxySet nonce="applepie!"
> 
> Longer term, I think that's a more "strategic" solution.
> 
> On Aug 31, 2012, at 2:14 PM, Stefan Fritsch <sf@sfritsch.de> wrote:
> 
>> On Friday 31 August 2012, Eric Covener wrote:
>>> I'm fighting a problem on new releases of AIX where in some
>>> environments, /dev/random seems to run out of entropy way too
>>> quick.
>>> 
>>> I'd like a way to suppress the apr_uuid_get->
>>> apr_generate_random_bytes() in mod_proxy_balancer used for the
>>> balancer-manager nonce in affected environments.
>>> 
>>> I was thinking a global "BalancerManager off" could be used for
>>> this and would also have the upside of fixing the SetHandler
>>> htaccess problem.
>>> 
>>> Alternatives would be to find a weaker source for the nonce, or
>>> allow tto opt out / use a hard-coded one.
>>> 
>>> Any suggestions?
>> 
>> For 2.4, you could use ap_random_insecure_bytes(). It should be good 
>> enough for a nonce.
>> 
>> If you add a "BalancerManager off", it should be per directory, or at 
>> least per vhost. Otherwise it would not help that much with the 
>> SetHandler htaccess problem.
>> 
>