Re: mod_security for Apache

A security team has indicated that web pages that contain variables that
are not checked to eliminate scripting attacks will not pass PCI
compliance, a relatively recent thing.
This is of most significance with regard to web sites that capture
credit card details.
Complacency regarding hacking attacks is common.
I bet there are many who are oblivious to how much such traffic is
coming out of China.




-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]
On Behalf Of Mike
Sent: Wednesday, 11 February 2009 8:32 a.m.
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] mod_security for Apache

My question is if this is such an important module, why hasn't IBM
ported it and included in within the installation. My guess is either
isn't a important as some lead you to think or i5/OS is secure enough
that it isn't needed.

--
Mike Wills
Midrange Programmer/Analyst
http://mikewills.info
http://www.linkedin.com/in/mikewills


On Tue, Feb 10, 2009 at 12:27 PM, Peter Connell <
Peter.Connell@xxxxxxxxxxxxxxxxx> wrote:

Yes, one would hope that if was all so easy to take advantage of such

a

frequently suggested security module then someone in the OS400

community

would have broken this ground some time ago. There is always some
apprehension in attempting to explain that the most significant

gateway

for the enterprise is protected because I downloaded something from

the

web.

-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]
On Behalf Of Haas, Matt (CL Tech Sv)
Sent: Wednesday, 11 February 2009 0:01
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] mod_security for Apache

You could also download and compile the module. I took a look at the
install documentation and they do not say you have to re-build Apache.
You could also likely use AIX binaries of this module (and its
dependencies). The InfoCenter has information on building additional
modules for the HTTP server.

Matt

-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]
On Behalf Of Nathan Andelin
Sent: Tuesday, February 10, 2009 6:53 AM
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] mod_security for Apache

From: Peter Connell
If IBM fail to provide a way to implement mod_security then the
other options are installing an application firewall in front ...

Well, at least you have that option.

One other thought that occurred to me was to try running an

open-source

version of Apache under PASE - a version that has mod_security

built-in,

as a proxy in front of the IBM i HTTP server. But I know little about
getting software to run under PASE.

Does Zend Core come with mod_security?

Nathan.




--
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.


--
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.

########################################################################
#############

This correspondence is for the named person's use only. It may contain
confidential or legally privileged information, or both. No

confidentiality

or privilege is waived or lost by any mistransmission. If you receive

this

correspondence in error, please immediately delete it from your system

and

notify the sender. You must not disclose, copy or rely on any part of

this

correspondence if you are not the intended recipient. Any views

expressed in

this message are those of the individual sender, except where the

sender

expressly, and with authority, states them to be the views of Veda
Advantage. If you need assistance, please contact Veda Advantage on

either

:- Australia 133124 or New Zealand +64 9 367 6200
--
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.