Re: random token re-used in subsequent requests

On Mon, 16 May 2016 22:45:14 +0000
"Bruce  Johnson" <[email protected]> wrote:

> 
> I don’t think it would be likely for Vincent to ever see this once, let alone have it rise to the issue of a problem if it were strictly about non-randomness of the rand() function.
> 

Indeed : I also use the function to generate cookies; the strings are stored in a database table with a primary key on the token ; running 'ab -c 4 -n 4000 "http://my/url/here"' 3 times yields 12 000 unique keys on a functional server. 

The machine where the error showed up can't get two different strings in a row. It's a backup server, so I'm the only one using it for test purposes, which is why I did not notice the error before; it may have been present for a long time.

Below is what is installed on each machine, the first one (arsene) being the faulty one; it is a rather old Dell desktop, the others are dedicated servers in datacenters, such as kimsufi.com, online.net. Everything is on bare metal, and incidentally not as uniform as I thought :-(
reload-perl is installed but disabled in apache2.conf

perl -v on the faulty machine (arsene) :
This is perl 5, version 20, subversion 2 (v5.20.2) built for i586-linux-gnu-thread-multi-64int
perl -v on the good ones :
This is perl 5, version 20, subversion 2 (v5.20.2) built for x86_64-linux-gnu-thread-multi


arsene (cpuinfo : Intel(R) Core(TM)2 Duo CPU     E7500  @ 2.93GHz)
ii  apache2                          2.4.10-10+deb8u4       i386         Apache HTTP Server
ii  apache2-bin                      2.4.10-10+deb8u4       i386         Apache HTTP Server (modules and other binary files)
ii  apache2-data                     2.4.10-10+deb8u4       all          Apache HTTP Server (common files)
ii  apache2-mpm-prefork              2.4.10-10+deb8u4       i386         transitional prefork MPM package for apache2
ii  apache2-utils                    2.4.10-10+deb8u4       i386         Apache HTTP Server (utility programs for web servers)
ii  apache2.2-common                 2.4.10-10+deb8u4       i386         Transitional package for apache2
ii  libapache2-mod-apreq2            2.13-4+b1              i386         generic Apache request library - Apache module
ii  libapache2-mod-perl2             2.0.9~1624218-2+deb8u1 i386         Integration of perl with the Apache2 web server
ii  libapache2-reload-perl           0.12-3                 all          module for reloading Perl modules when changed on disk
ii  libapache2-request-perl          2.13-4+b1              i386         generic Apache request library - Perl modules

kimsufi (cpuinfo : Intel(R) Atom(TM) CPU N2800   @ 1.86GHz)
ii  apache2                          2.4.10-10+deb8u4       amd64        Apache HTTP Server
ii  apache2-bin                      2.4.10-10+deb8u4       amd64        Apache HTTP Server (modules and other binary files)
ii  apache2-data                     2.4.10-10+deb8u4       all          Apache HTTP Server (common files)
ii  apache2-mpm-prefork              2.4.10-10+deb8u4       amd64        transitional prefork MPM package for apache2
ii  apache2-utils                    2.4.10-10+deb8u4       amd64        Apache HTTP Server (utility programs for web servers)
ii  apache2.2-common                 2.4.10-10+deb8u4       amd64        Transitional package for apache2
ii  libapache2-mod-apreq2            2.13-4+b1              amd64        generic Apache request library - Apache module
ii  libapache2-mod-perl2             2.0.9~1624218-2+deb8u1 amd64        Integration of perl with the Apache2 web server
ii  libapache2-reload-perl           0.12-3                 all          module for reloading Perl modules when changed on disk
ii  libapache2-request-perl          2.13-4+b1              amd64        generic Apache request library - Perl modules

online (cpuinfo : VIA Nano processor U2250 (1.6GHz Capable))
ii  apache2                   2.4.10-10+deb8u4       amd64        Apache HTTP Server
ii  apache2-bin               2.4.10-10+deb8u4       amd64        Apache HTTP Server (modules and other binary files)
ii  apache2-data              2.4.10-10+deb8u4       all          Apache HTTP Server (common files)
ii  apache2-mpm-prefork       2.4.10-10+deb8u4       amd64        transitional prefork MPM package for apache2
ii  apache2-utils             2.4.10-10+deb8u4       amd64        Apache HTTP Server (utility programs for web servers)
ii  libapache2-mod-apreq2     2.13-4+b1              amd64        generic Apache request library - Apache module
ii  libapache2-mod-perl2      2.0.9~1624218-2+deb8u1 amd64        Integration of perl with the Apache2 web server
ii  libapache2-request-perl   2.13-4+b1              amd64        generic Apache request library - Perl modules

ovh (cpuinfo : Intel(R) Celeron(R) CPU          220  @ 1.20GHz)
ii  apache2                   2.4.10-10+deb8u4       amd64        Apache HTTP Server
ii  apache2-bin               2.4.10-10+deb8u4       amd64        Apache HTTP Server (modules and other binary files)
ii  apache2-data              2.4.10-10+deb8u4       all          Apache HTTP Server (common files)
ii  apache2-utils             2.4.10-10+deb8u4       amd64        Apache HTTP Server (utility programs for web servers)
ii  libapache2-mod-apreq2     2.13-4+b1              amd64        generic Apache request library - Apache module
ii  libapache2-mod-perl2      2.0.9~1624218-2+deb8u1 amd64        Integration of perl with the Apache2 web server
ii  libapache2-reload-perl    0.12-3                 all          module for reloading Perl modules when changed on disk
ii  libapache2-request-perl   2.13-4+b1              amd64        generic Apache request library - Perl modules

-- 
					Bien à vous, Vincent Veyron

https://marica.fr/
Gestion des sinistres assurance et des dossiers juridiques