Re: mod_security for Apache

IBM actually builds in a lot of modules that are not in the standard version from Apache.org. There's a way to get the list with the STRTCPSVR command but you'll have to look in the InfoCenter for specifics. Also, I'm pretty sure you can download the source and compile it on the i but you'll miss out on the i specific integration that IBM did. Worst case is you have to run it in PASE (which is what Zend does).

In this case, it's a moot point. If you look at the documentation for this module, it says to include it in the httpd.conf file which is how most third party modules are installed. IBM even does this for things like SSL and WebSphere.

Matt
-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx] On Behalf Of franz400@xxxxxxxxxxxx
Sent: Wednesday, February 11, 2009 11:28 AM
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] mod_security for Apache

Perhaps I did not understand the issue.. it sounded to me like
IBM's providing a version of Apache, installed with a RSTLICPGM,
that contains "most" of what is in a standard Apache install on
other platforms, plus extensions for the i.
Is the mod_security part of an official Apache release? If IBM
says we are compatible with that release, but missing that feature,
that is my problem...(and pardon me if I don't understand the issue
fully).
<my rant>
I am not up on what is in or not in the i Apache release, but in all the
ip related parts of the i, it seems we often hit the "not supported" issue.
I often wish IBM would build in a Linux server as part of every system
to cover these missing pieces, because my customers just don't get "you need
to buy more" or"do more" or "put in another server" to do something.
This was not my issue, I was merely commenting on someone else's problem.
My problem lately is to support authenticated smtp to php running
on the i...
</rant>
Jim Franz

---- "Haas wrote:

<rant>
One thing I don't understand is why there is so much reliance on IBM to do *everything* for the i. The whole reason this is available on Windows and *nix platforms is because someone took the time to develop it in the first place and port it to the platforms it has binaries for. This doesn't appear to be vendor driven at all.

It seems to me like a lot of the i's image problems are caused by people's unwillingness to do things for themselves. It's great when IBM delivers things but the basic building blocks to do pretty much anything are already there and IBM provides guides (and even help in some cases) on porting software from other platforms so why not give it a try and see what happens? Worst case is it doesn't work and you'll have to find another solution.
</rant>

Matt

-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx] On Behalf Of Jim Franz
Sent: Tuesday, February 10, 2009 9:37 PM
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] mod_security for Apache

perhaps this should be raised with IBM at Common during soundoff.
There have been times when IBM offers more security in the win/unix
versions than in the similar "i" offering - and then says we should put that
win/x stuff in front of our i for secure web serving.
It would truly s*** if a "i" web solution can't pass PCI compliance!
(unless the industry standard best practices PCI way of doing this is the
external appliance?)

Jim Franz

----- Original Message -----
From: "Peter Connell" <Peter.Connell@xxxxxxxxxxxxxxxxx>
To: "Web Enabling the AS400 / iSeries" <web400@xxxxxxxxxxxx>
Sent: Tuesday, February 10, 2009 3:31 PM
Subject: Re: [WEB400] mod_security for Apache

It may come that if mod_security is the most expedient and viable option
but when it comes to a global security solution I prefer to have someone
to follow, not lead.

-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]
On Behalf Of Haas, Matt (CL Tech Sv)
Sent: Wednesday, 11 February 2009 9:02 a.m.
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] mod_security for Apache

But isn't that exactly what you're being asked to do?

Matt

-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]
On Behalf Of Peter Connell
Sent: Tuesday, February 10, 2009 1:27 PM
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] mod_security for Apache

Yes, one would hope that if was all so easy to take advantage of such a
frequently suggested security module then someone in the OS400 community
would have broken this ground some time ago. There is always some
apprehension in attempting to explain that the most significant gateway
for the enterprise is protected because I downloaded something from the
web.

-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]
On Behalf Of Haas, Matt (CL Tech Sv)
Sent: Wednesday, 11 February 2009 0:01
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] mod_security for Apache

You could also download and compile the module. I took a look at the
install documentation and they do not say you have to re-build Apache.
You could also likely use AIX binaries of this module (and its
dependencies). The InfoCenter has information on building additional
modules for the HTTP server.

Matt

-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]
On Behalf Of Nathan Andelin
Sent: Tuesday, February 10, 2009 6:53 AM
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] mod_security for Apache

From: Peter Connell
If IBM fail to provide a way to implement mod_security then the other
options are installing an application firewall in front ...

Well, at least you have that option.

One other thought that occurred to me was to try running an open-source
version of Apache under PASE - a version that has mod_security built-in,
as a proxy in front of the IBM i HTTP server. But I know little about
getting software to run under PASE.

Does Zend Core come with mod_security?

Nathan.

--
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.