Apache Week issue 317
Apache Week <[email protected]> Fri, 20 Dec 2002 16:47:04 +0100
| Newsgroups | gmane.comp.apache.apacheweek |
|---|---|
| Message-ID | <[email protected]> |
APACHE WEEK
The essential weekly guide for users of the world's most popular Web server.
Issue 317: 20th December 2002
In this issue
* Under development
* Featured articles
* Book Reviews
* Apache Week giveaway
Under development
An article published by eWeek earlier this year covered an
[1]incompatibility between the implementations of the digest
authentication specification ([2]RFC 2617) in Microsoft Internet
Explorer and Apache, although no specific details were revealed in
the article. More light was shed on the issue this week as it was
discovered that when requests sent by Internet Explorer to a
location protected by mod_auth_digest where the URL includes a
query string (such as /cgi-bin/script.pl?id=foobar), authorisation
will always fail. This appears to be because Internet Explorer
sends an incorrect WWW-Authorization header for such URLs; no
workaround is known, though several techniques were suggested to
avoid using query strings in protected locations; using POST for
forms, or using PATH_INFO to avoid explicit query strings.
In other news, [3]Ryan Bloom's patch to add TLS upgrade support (as
covered in [4]issue 312) was committed to the Apache 2.1 CVS tree.
The stable 2.0 tree was tagged on the 7th of this month to prepare
for a 2.0.44 release; there has been little movement on a release
since then.
Featured articles
In this section we highlight some of the articles on the web that
are of interest to Apache users.
We start this week with a little bit of a Mac OS theme. David
Wheeler builds on his earlier articles about the default Apache
install on Mac OS X with an article: [5]"Build Your Own Apache
Server with mod_perl and mod_ssl". This article gives Mac OS X
users everything they need to know about how to compile Apache with
custom modules.
In [6]"Getting Fit for the Holidays", Daniel Steinberg looks at
interacting with Java programs remotely by taking advantage of the
Apache Web Server that ships with Mac OS X. He takes a look at the
newly released Fit framework and introduces some of the
possibilities available for using CGI on a Mac.
Long-time Apache developer [7]Randy Terbush is interviewed for
[8]"Companies need to plug in to open-source" and cites many
examples of Apache Software Foundation projects.
"Eventually, it will be considered acceptable for a company to use
the source code as it comes from the Apache Software Foundation to
deploy an application, Web server or SOAP Web services stack. Or to
use Linux as it comes from some other pre-distribution. Or to have
their own variant of Unix or Apache in-house with their own
modifications."
O'Reilly look at [9]"Configuring Tomcat with IIS Web Server" by
using the JK Connectors. This article follows on from
[10]"Configuring Tomcat and Apache With JK 1.2" and it is
interesting to compare the two solutions.
ZDNet warn that you need to [11]"Avoid security complacency", and
cite an example where one of their own systems that was not kept up
to date became compromised.
"Unfortunately one of our staff was on holidays... We missed a
patch to the Apache Server SSL by a couple of days and during this
time the Worm exploited a flaw in the SSL security"
However, fixes for the OpenSSL vulnerability mentioned were
publically available for over 45 days before the worm started
infecting systems (much more than the "couple of days" quoted).
Administrators should have had plenty of time to learn about the
threat to their systems and respond to it by patching or upgrading
the packages. The paper [12]"Apache Security Secrets: Revealed"
presented at Apache Con 2002 by Apache Week's editor, [13]Mark Cox,
examines this specific issue in more detail.
Book Reviews
This month we were sent three out of the eight books in the Craig
Hunt Linux Library series published by Sybex Inc. The first book is
the second edition of "Linux Apache Web Server Administration" by
Charles Aulds, followed by the second edition of "Linux System
Administration" by Vicki Stanfield, and Roderick W. Smith. Both
books were published in September 2002 and reviewed by Craig Hunt.
The third book is "Linux Network Servers" written by Craig Hunt
himself published in August 2002.
"Linux Apache Web Server Administration" is written for well-versed
Linux administrators who use Apache as their web servers in a small
to medium-sized company. It provides a good coverage of the topics
needed to arm an administrator with sufficient knowledge to get the
Apache web server up and running, and also administer and maintain
it.
Although this second edition has been updated to include Apache
2.0, it is not the definitive guide to Apache 2.0 since it does not
focus on the new features of Apache 2.0 or the differences between
Apache 1.3 and 2.0. This book is therefore not for experienced
Apache web server administrators who are seeking guidance in
migrating from Apache 1.3 to version 2.0. However, it is well
suited to experienced Linux system administrators who are new to
Apache as it is easy to understand, starts from the basics, and
walks you through step-by-step instructions to ensure that you are
well equipped to set up and maintain your very first Apache web
server.
[14]Read our full review
Apache Week giveaway
For a chance to get your hands a copy of a set of books "Linux
Apache Web Server Administration", "Linux System Administration",
and "Linux Network Servers", just match the punchline to this
festive joke:
How do a group of penguins make a decision ?
A) With a motor-pike and side-carp
B) At the whale-weigh station
C) Flipper coin
Send your answer to [15][email protected] to reach us no
later than January 5th 2002. Your email address will not be used
for anything other than to let you know if you won. One winner will
be drawn at random from all correct entries submitted. One entry
per person, no cash alternative, editors' decision is final, bah
Humbug!
Holiday break
Apache Week will be back on the 10th January 2003. February 2003
will mark our eighth year on the web; that's eight years of being
the most comprehensive publication for users of the Apache Web
server. You don't want to miss it!
______________________________________________________________
This issue brought to you by: Mark J Cox, Joe Orton, Min Min Tsan
Comments or criticisms? Please email us at
[16][email protected].
[17]Apache Week is copyright 1996-2002 by [18]Red Hat, Inc.
References
1. http://www.eweek.com/article2/0,3959,26263,00.asp
2. http://www.ietf.org/rfc/rfc2617.txt
3. http://httpd.apache.org/contributors/#bloom
4. http://www.apacheweek.com/issues/02-10-18#dev
5. http://www.macdevcenter.com/pub/a/mac/2002/12/18/apache_modssl.html
6. http://www.macdevcenter.com/pub/a/mac/2002/12/10/osx_java.html
7. http://httpd.apache.org/contributors/#terbush
8. http://searchwin2000.techtarget.com/qna/0,289202,sid1_gci867256,00.html
9. http://www.onjava.com/pub/a/onjava/2002/12/18/tomcat.html
10. http://www.onjava.com/pub/a/onjava/2002/11/20/tomcat.html
11. http://www.zdnet.com.au/newstech/security/story/0,2000024985,20270238,00.htm
12. http://www.awe.com/mark/apcon2002/
13. http://httpd.apache.org/contributors/#cox
14. http://www.apacheweek.com/features/book-linuxlibrary
15. mailto:[email protected]
16. mailto:[email protected]
17. http://www.apacheweek.com/
18. http://www.redhat.com/
----------------------------------------------------------------------
To unsubscribe: https://listman.redhat.com/mailman/listinfo/apacheweek
or send the message "unsubscribe" to [email protected]
----------------------------------------------------------------------