You are viewing a plain text version of this content. The canonical link for it is here.

Posted to mirrors@apache.org by Andrew Kenna <an...@stamina.com.au> on 2002/10/24 06:06:11 UTC

Mirror Update time

People, please follow the steps outlines on http://httpd.apache.org/
The following are mirrors that are no longer valid, meaning 1 of the following

1) They are un-reachable
2) They do not contain the latest version of apache
3) They are running a version of apache pre-dating 1.3.26

Does anyone have any problems with removing mirror sites that are running versions of apache prior to 1.3.26 ? 

If not, and if I don't hear anything from the guys(after waiting 1 week) that maintain these web sites listed below they will all be removed from the official apache mirrors list.

http://gd.tuwien.ac.at/infosys/servers/http/apache/dist/
http://www.fokus.gmd.de/apache/dist/httpd/
http://ftp.heanet.ie/mirrors/www.apache.org/dist/
http://apache.fresh.co.il/dist/
http://apache.happysize.co.jp/
http://mirror.nucba.ac.jp/mirror/apache/dist/ - Apache 1.3.14
http://elfas.kauko.lt/dist/ - Apache 1.3.23
http://myapache.i-ownur.info/
http://sunsite.icm.edu.pl/apache/dist/ - Apache 1.3.9
http://apache.chg.ru/dist/ - Apache 1.3.22
http://apache.en.com.sg/
http://apache.siol.net/dist/ - Apache 1.3.4( this guy wins the for oldest verion of apache running on a mirror site)
http://noc.cvaix.com/mirrors/apache/
http://www.apache.inetcosmos.org/dist/ - Apache 1.3.19
http://apache.insync.za.net/ - Apache 1.3.22
http://apache.mirrorcentral.com/dist/ - Apache 1.3.23
http://apache.ttlhost.com/ - Apache 1.3.23
http://mirrors.ccs.neu.edu/Apache/dist/ - Apache 1.3.14

Re: Mirror Update time

Posted by Aaron Bannert <aa...@clove.org>.

On Thu, Oct 24, 2002 at 02:06:11PM +1000, Andrew Kenna wrote:
> Does anyone have any problems with removing mirror sites that are running versions of apache prior to 1.3.26 ? 

We should simply ask those admins if they patched the whole or are aware
of the security concerns. There's a chance they just updated the RedHat
RPM (for one example) that fixed the hole w/o bumping to 1.3.27.

-aaron

Re: Mirror Update time

Posted by Thom May <th...@positive-internet.com>.

* Ken Smith (kensmith@cse.Buffalo.EDU) wrote :
> On Thu, Oct 24, 2002 at 05:49:20PM +0100, Thom May wrote:
> 
> > Unpatched versions, yes. As I said earlier in the thread, most distributions
> > backport patches to older versions rather than introduce new versions in
> > stable distributions. How are you planning to test for this?
> 
> Ok, I was lost in what you were calling a distribution.  You're
> talking about, e.g. RedHat backporting security patches to the
> Apache version they bundled into RedHat 6.2.
> 
Exactly.

> Ick.  Convince distribution makers to diddle with the version number
> by tacking on a patched-to date?  :-/
>
Good luck ;-)
-Thom

Re: Mirror Update time

Posted by Ken Smith <ke...@cse.Buffalo.EDU>.

On Thu, Oct 24, 2002 at 05:49:20PM +0100, Thom May wrote:

> Unpatched versions, yes. As I said earlier in the thread, most distributions
> backport patches to older versions rather than introduce new versions in
> stable distributions. How are you planning to test for this?

Ok, I was lost in what you were calling a distribution.  You're
talking about, e.g. RedHat backporting security patches to the
Apache version they bundled into RedHat 6.2.

Ick.  Convince distribution makers to diddle with the version number
by tacking on a patched-to date?  :-/

-- 
						Ken Smith
- From there to here, from here to      |       kensmith@cse.buffalo.edu
  there, funny things are everywhere.   |
                      - Theodore Geisel |

Re: Mirror Update time

Posted by Thom May <th...@positive-internet.com>.

* Ken Smith (kensmith@cse.Buffalo.EDU) wrote :
> On Thu, Oct 24, 2002 at 05:00:23PM +0100, Thom May wrote:
> > * myfriend.is.not.my.enemies.org (ikmal_ahmad@yahoo.com) wrote :
> > > 
> > > Actually Andrew concern is about security for all apache mirror.
> > > I think this can seatle if every administrator/maintainer apply pathes for their Apache webserver.  But how we know's which Apache have been patch or not.  I think that's why Andrew want to do like that.
> > >  
> > Apache may suggest that the best practise would be to run 1.3.26 or better;
> > but it's a decision that is _entirely_ up to the server admins who are
> > _freely_ donating time and resources.
> > -Thom
> 
> The counterpoint to that being Apache has the "responsibility" of
> making their distribution channel as free of potential tampering
> as possible.  httpd versionf older than 1.3.26 have known security
> issues that can allow remote attackers access to the machine and
> the opportunity to tamper with the files being distributed.
> 
Unpatched versions, yes. As I said earlier in the thread, most distributions
backport patches to older versions rather than introduce new versions in
stable distributions. How are you planning to test for this?

> If the mirror admins are interested in helping out Apache by donating
> their time and resources perhaps they can extend that interest enough
> to help make the distribution mechanism as trustworthy (hack-proof)
> as possible.  In this day and age of "the bad guys" playing games
> with attacking the root DNS servers and whatnot IMO it isn't out of
> line for Apache to request the *official* mirrors be secure within
> reason.
>
I think running an older version with the correct patchset is totally within
reason.
-Thom

Re: Mirror Update time

Posted by Ken Smith <ke...@cse.Buffalo.EDU>.

On Thu, Oct 24, 2002 at 05:00:23PM +0100, Thom May wrote:
> * myfriend.is.not.my.enemies.org (ikmal_ahmad@yahoo.com) wrote :
> > 
> > Actually Andrew concern is about security for all apache mirror.
> > I think this can seatle if every administrator/maintainer apply pathes for their Apache webserver.  But how we know's which Apache have been patch or not.  I think that's why Andrew want to do like that.
> >  
> Apache may suggest that the best practise would be to run 1.3.26 or better;
> but it's a decision that is _entirely_ up to the server admins who are
> _freely_ donating time and resources.
> -Thom

The counterpoint to that being Apache has the "responsibility" of
making their distribution channel as free of potential tampering
as possible.  httpd versionf older than 1.3.26 have known security
issues that can allow remote attackers access to the machine and
the opportunity to tamper with the files being distributed.

If the mirror admins are interested in helping out Apache by donating
their time and resources perhaps they can extend that interest enough
to help make the distribution mechanism as trustworthy (hack-proof)
as possible.  In this day and age of "the bad guys" playing games
with attacking the root DNS servers and whatnot IMO it isn't out of
line for Apache to request the *official* mirrors be secure within
reason.

-- 
						Ken Smith
- From there to here, from here to      |       kensmith@cse.buffalo.edu
  there, funny things are everywhere.   |
                      - Theodore Geisel |

Re: Mirror Update time

Posted by Thom May <th...@positive-internet.com>.

* myfriend.is.not.my.enemies.org (ikmal_ahmad@yahoo.com) wrote :
> 
> Actually Andrew concern is about security for all apache mirror.
> I think this can seatle if every administrator/maintainer apply pathes for their Apache webserver.  But how we know's which Apache have been patch or not.  I think that's why Andrew want to do like that.
>  
Apache may suggest that the best practise would be to run 1.3.26 or better;
but it's a decision that is _entirely_ up to the server admins who are
_freely_ donating time and resources.
-Thom

Re: Mirror Update time

Posted by Ask Bjoern Hansen <as...@perl.org>.

On Thu, 24 Oct 2002, Aaron Bannert wrote:

> > for anyone to operate an official mirror is to help apache foundation to
> > begin with, and I believe each mirror should be proactive in its
> > responsibilities, including security.
>
> It would be neat if we had an automated tool that could collect the
> version numbers (and maybe other automatically collectible info) from
> each of our mirrors.

http://www.apache.org/~ask/mirror_versions.txt

There are some seriously ancient versions running...


 - ask

-- 
ask bjoern hansen, http://askbjoernhansen.com/  !try;
develooper llc,    http://www.develooper.com/   do();

Re: Mirror Update time

Posted by Aaron Bannert <aa...@clove.org>.

On Thu, Oct 24, 2002 at 08:22:43PM -0400, Haesu wrote:
> Hello,
> 	I personally believe that everyone operating the mirror must run
> at least 1.3.26 or above.. I mean it would be better if all the mirrors
> are *totally secure* from any possibilities of exploits, rather than just
> cutting corners with redhat rpm updates that fix the problem w/o upgrading
> completely. Accepted, my opinion may not be 100% correct. But the reason
> for anyone to operate an official mirror is to help apache foundation to
> begin with, and I believe each mirror should be proactive in its
> responsibilities, including security.

It would be neat if we had an automated tool that could collect the
version numbers (and maybe other automatically collectible info) from
each of our mirrors.

-aaron

Re: Mirror Update time

Posted by Haesu <ha...@towardex.com>.

Hello,
	I personally believe that everyone operating the mirror must run
at least 1.3.26 or above.. I mean it would be better if all the mirrors
are *totally secure* from any possibilities of exploits, rather than just
cutting corners with redhat rpm updates that fix the problem w/o upgrading
completely. Accepted, my opinion may not be 100% correct. But the reason
for anyone to operate an official mirror is to help apache foundation to
begin with, and I believe each mirror should be proactive in its
responsibilities, including security.

--HC


On Thu, 24 Oct 2002, myfriend.is.not.my.enemies.org wrote:

>
> Actually Andrew concern is about security for all apache mirror.
> I think this can seatle if every administrator/maintainer apply pathes for their Apache webserver.  But how we know's which Apache have been patch or not.  I think that's why Andrew want to do like that.
>
>  Thom May <th...@positive-internet.com> wrote: * Andrew Kenna (andrewk@stamina.com.au) wrote :
> > People, please follow the steps outlines on http://httpd.apache.org/
> > The following are mirrors that are no longer valid, meaning 1 of the following
> >
> > 1) They are un-reachable
> > 2) They do not contain the latest version of apache
> > 3) They are running a version of apache pre-dating 1.3.26
> >
> > Does anyone have any problems with removing mirror sites that are running versions of apache prior to 1.3.26 ?
>
> Yes, this is bogus. Most OS distributions prefer to backport patches rather
> than enforce an upgrade on their users.
> Debian's 2.2 release (the last but one, and still recieving updates) has a
> fully patched 1.3.9 version in, which is as secure as 1.3.26.
> So you're just causing admins extra work for no real reason.
> -Thom
>
>
> ---------------------------------
> Do you Yahoo!?
> Y! Web Hosting - Let the expert host your web site

Re: Mirror Update time

Posted by "myfriend.is.not.my.enemies.org" <ik...@yahoo.com>.

Actually Andrew concern is about security for all apache mirror.
I think this can seatle if every administrator/maintainer apply pathes for their Apache webserver.  But how we know's which Apache have been patch or not.  I think that's why Andrew want to do like that.
 
 Thom May <th...@positive-internet.com> wrote: * Andrew Kenna (andrewk@stamina.com.au) wrote :
> People, please follow the steps outlines on http://httpd.apache.org/
> The following are mirrors that are no longer valid, meaning 1 of the following
> 
> 1) They are un-reachable
> 2) They do not contain the latest version of apache
> 3) They are running a version of apache pre-dating 1.3.26
> 
> Does anyone have any problems with removing mirror sites that are running versions of apache prior to 1.3.26 ? 

Yes, this is bogus. Most OS distributions prefer to backport patches rather
than enforce an upgrade on their users. 
Debian's 2.2 release (the last but one, and still recieving updates) has a
fully patched 1.3.9 version in, which is as secure as 1.3.26.
So you're just causing admins extra work for no real reason.
-Thom


---------------------------------
Do you Yahoo!?
Y! Web Hosting - Let the expert host your web site

Re: Mirror Update time

Posted by Thom May <th...@positive-internet.com>.

* Andrew Kenna (andrewk@stamina.com.au) wrote :
> People, please follow the steps outlines on http://httpd.apache.org/
> The following are mirrors that are no longer valid, meaning 1 of the following
> 
> 1) They are un-reachable
> 2) They do not contain the latest version of apache
> 3) They are running a version of apache pre-dating 1.3.26
> 
> Does anyone have any problems with removing mirror sites that are running versions of apache prior to 1.3.26 ? 

Yes, this is bogus. Most OS distributions prefer to backport patches rather
than enforce an upgrade on their users. 
Debian's 2.2 release (the last but one, and still recieving updates) has a
fully patched 1.3.9 version in, which is as secure as 1.3.26.
So you're just causing admins extra work for no real reason.
-Thom

Re: Mirror Update time

Posted by "myfriend.is.not.my.enemies.org" <ik...@yahoo.com>.

I think it will create some misunderstanding here.
How about if the person have do the patches from the source but still use the old version of apache.  That version also did not venureable( i guess).
 Steve Mitchell <st...@mirrorcentral.com> wrote:So you want to remove people that aren't running 1.3.26 or greater 
because? 

Andrew Kenna wrote:

>People, please follow the steps outlines on http://httpd.apache.org/
>The following are mirrors that are no longer valid, meaning 1 of the following
>
>1) They are un-reachable
>2) They do not contain the latest version of apache
>3) They are running a version of apache pre-dating 1.3.26
>
>Does anyone have any problems with removing mirror sites that are running versions of apache prior to 1.3.26 ? 
>
>If not, and if I don't hear anything from the guys(after waiting 1 week) that maintain these web sites listed below they will all be removed from the official apache mirrors list.
>
>http://gd.tuwien.ac.at/infosys/servers/http/apache/dist/
>http://www.fokus.gmd.de/apache/dist/httpd/
>http://ftp.heanet.ie/mirrors/www.apache.org/dist/
>http://apache.fresh.co.il/dist/
>http://apache.happysize.co.jp/
>http://mirror.nucba.ac.jp/mirror/apache/dist/ - Apache 1.3.14
>http://elfas.kauko.lt/dist/ - Apache 1.3.23
>http://myapache.i-ownur.info/
>http://sunsite.icm.edu.pl/apache/dist/ - Apache 1.3.9
>http://apache.chg.ru/dist/ - Apache 1.3.22
>http://apache.en.com.sg/
>http://apache.siol.net/dist/ - Apache 1.3.4( this guy wins the for oldest verion of apache running on a mirror site)
>http://noc.cvaix.com/mirrors/apache/
>http://www.apache.inetcosmos.org/dist/ - Apache 1.3.19
>http://apache.insync.za.net/ - Apache 1.3.22
>http://apache.mirrorcentral.com/dist/ - Apache 1.3.23
>http://apache.ttlhost.com/ - Apache 1.3.23
>http://mirrors.ccs.neu.edu/Apache/dist/ - Apache 1.3.14
> 
>




---------------------------------
Do you Yahoo!?
Y! Web Hosting - Let the expert host your web site

Re: Mirror Update time

Posted by Steve Mitchell <st...@mirrorcentral.com>.

So you want to remove people that aren't running 1.3.26 or greater 
because?  

Andrew Kenna wrote:

>People, please follow the steps outlines on http://httpd.apache.org/
>The following are mirrors that are no longer valid, meaning 1 of the following
>
>1) They are un-reachable
>2) They do not contain the latest version of apache
>3) They are running a version of apache pre-dating 1.3.26
>
>Does anyone have any problems with removing mirror sites that are running versions of apache prior to 1.3.26 ? 
>
>If not, and if I don't hear anything from the guys(after waiting 1 week) that maintain these web sites listed below they will all be removed from the official apache mirrors list.
>
>http://gd.tuwien.ac.at/infosys/servers/http/apache/dist/
>http://www.fokus.gmd.de/apache/dist/httpd/
>http://ftp.heanet.ie/mirrors/www.apache.org/dist/
>http://apache.fresh.co.il/dist/
>http://apache.happysize.co.jp/
>http://mirror.nucba.ac.jp/mirror/apache/dist/ - Apache 1.3.14
>http://elfas.kauko.lt/dist/ - Apache 1.3.23
>http://myapache.i-ownur.info/
>http://sunsite.icm.edu.pl/apache/dist/ - Apache 1.3.9
>http://apache.chg.ru/dist/ - Apache 1.3.22
>http://apache.en.com.sg/
>http://apache.siol.net/dist/ - Apache 1.3.4( this guy wins the for oldest verion of apache running on a mirror site)
>http://noc.cvaix.com/mirrors/apache/
>http://www.apache.inetcosmos.org/dist/ - Apache 1.3.19
>http://apache.insync.za.net/ - Apache 1.3.22
>http://apache.mirrorcentral.com/dist/ - Apache 1.3.23
>http://apache.ttlhost.com/ - Apache 1.3.23
>http://mirrors.ccs.neu.edu/Apache/dist/ - Apache 1.3.14
>  
>

Re: Mirror Update time

Posted by "myfriend.is.not.my.enemies.org" <ik...@yahoo.com>.

Just ignore this e-mail. It done already after I have some e-mail with Mr. Andrew. I think my e-mail can't go through coz the e-mail add that submit to mailing-list is different one.
Sorry about this.
Ikmal.
"myfriend.is.not.my.enemies.org" <ik...@yahoo.com> wrote:
Hi Mr Andrew,

I'm refering to http://myapache.i-ownur.info/ mirror url. I have change the pointing of our mirror to http://myapache.mybsd.org.my/. Just want some confirmation. Did I still need to upgrade my apache after I do the patches of my apache?

Here are the thing from my update.

[root@report root]# up2date --list

Fetching package list for channel: redhat-linux-i386-7.3...
########################################

Fetching Obsoletes list for channel: redhat-linux-i386-7.3...
########################################

Fetching rpm headers...

Name Version Rel
----------------------------------------------------------

None of the packages you requested were found, or they are already updated.
[root@report root]#

Sorry coz late update u about this changes.

Thanks,

Ikmal.

Andrew Kenna <an...@stamina.com.au> wrote: People, please follow the steps outlines on http://httpd.apache.org/
The following are mirrors that are no longer valid, meaning 1 of the following

1) They are un-reachable
2) They do not contain the latest version of apache
3) They are running a version of apache pre-dating 1.3.26

Does anyone have any problems with removing mirror sites that are running versions of apache prior to 1.3.26 ?

If not, and if I don't hear anything from the guys(after waiting 1 week) that maintain these web sites listed below they will all be removed from the official apache mirrors list.

http://gd.tuwien.ac.at/infosys/servers/http/apache/dist/
http://www.fokus.gmd.de/apache/dist/httpd/
http://ftp.heanet.ie/mirrors/www.apache.org/dist/
http://apache.fresh.co.il/dist/
http://apache.happysize.co.jp/
http://mirror.nucba.ac.jp/mirror/apache/dist/ - Apache 1.3.14
http://elfas.kauko.lt/dist/ - Apache 1.3.23
http://myapache.i-ownur.info/
http://sunsite.icm.edu.pl/apache/dist/ - Apache 1.3.9
http://apache.chg.ru/dist/ - Apache 1.3.22
http://apache.en.com.sg/
http://apache.siol.net/dist/ - Apache 1.3.4( this guy wins the for oldest verion of apache running on a mirror site)
http://noc.cvaix.com/mirrors/apache/
http://www.apache.inetcosmos.org/dist/ - Apache 1.3.19
http://apache.insync.za.net/ - Apache 1.3.22
http://apache.mirrorcentral.com/dist/ - Apache 1.3.23
http://apache.ttlhost.com/ - Apache 1.3.23
http://mirrors.ccs.neu.edu/Apache/dist/ - Apache 1.3.14

---------------------------------
Do you Yahoo!?
Y! Web Hosting - Let the expert host your web site

Re: Mirror Update time

Posted by "myfriend.is.not.my.enemies.org" <ik...@yahoo.com>.

Hi Mr Andrew,

Here are the thing from my update.

[root@report root]# up2date --list

Fetching package list for channel: redhat-linux-i386-7.3...
########################################

Fetching Obsoletes list for channel: redhat-linux-i386-7.3...
########################################

Fetching rpm headers...

Name Version Rel
----------------------------------------------------------

None of the packages you requested were found, or they are already updated.
[root@report root]#

Sorry coz late update u about this changes.

Thanks,

Ikmal.

Andrew Kenna <an...@stamina.com.au> wrote:People, please follow the steps outlines on http://httpd.apache.org/
The following are mirrors that are no longer valid, meaning 1 of the following

1) They are un-reachable
2) They do not contain the latest version of apache
3) They are running a version of apache pre-dating 1.3.26

Does anyone have any problems with removing mirror sites that are running versions of apache prior to 1.3.26 ?

If not, and if I don't hear anything from the guys(after waiting 1 week) that maintain these web sites listed below they will all be removed from the official apache mirrors list.

---------------------------------
Do you Yahoo!?
Y! Web Hosting - Let the expert host your web site

Re: Mirror Update time

Posted by Serge Krashakov <sa...@Chg.RU>.

On Thu, 24 Oct 2002, Andrew Kenna wrote:

> People, please follow the steps outlines on http://httpd.apache.org/
> The following are mirrors that are no longer valid, meaning 1 of the following
> 
> 1) They are un-reachable
> 2) They do not contain the latest version of apache
> 3) They are running a version of apache pre-dating 1.3.26
> 
> Does anyone have any problems with removing mirror sites that are running versions of apache prior to 1.3.26 ? 
> 
> If not, and if I don't hear anything from the guys(after waiting 1 week) that maintain these web sites listed below they will all be removed from the official apache mirrors list.
> 
> http://gd.tuwien.ac.at/infosys/servers/http/apache/dist/
> http://www.fokus.gmd.de/apache/dist/httpd/
> http://ftp.heanet.ie/mirrors/www.apache.org/dist/
> http://apache.fresh.co.il/dist/
> http://apache.happysize.co.jp/
> http://mirror.nucba.ac.jp/mirror/apache/dist/ - Apache 1.3.14
> http://elfas.kauko.lt/dist/ - Apache 1.3.23
> http://myapache.i-ownur.info/
> http://sunsite.icm.edu.pl/apache/dist/ - Apache 1.3.9
> http://apache.chg.ru/dist/ - Apache 1.3.22

Just now I have apdated apache version at apache.chg.ru up to 1.3.26

> http://apache.en.com.sg/
> http://apache.siol.net/dist/ - Apache 1.3.4( this guy wins the for oldest verion of apache running on a mirror site)
> http://noc.cvaix.com/mirrors/apache/
> http://www.apache.inetcosmos.org/dist/ - Apache 1.3.19
> http://apache.insync.za.net/ - Apache 1.3.22
> http://apache.mirrorcentral.com/dist/ - Apache 1.3.23
> http://apache.ttlhost.com/ - Apache 1.3.23
> http://mirrors.ccs.neu.edu/Apache/dist/ - Apache 1.3.14
> 

Best regards, Serge Krashakov

RE: Mirror Update time

Posted by Neo Wee Teck <sl...@en.com.sg>.

http://apache.en.com.sg

Upz :)



-----Original Message-----
From: Andrew Kenna [mailto:andrewk@stamina.com.au] 
Sent: Thursday, October 24, 2002 12:06 PM
To: mirrors@apache.org
Subject: Mirror Update time

People, please follow the steps outlines on http://httpd.apache.org/
The following are mirrors that are no longer valid, meaning 1 of the
following

1) They are un-reachable
2) They do not contain the latest version of apache
3) They are running a version of apache pre-dating 1.3.26

Does anyone have any problems with removing mirror sites that are
running versions of apache prior to 1.3.26 ? 

If not, and if I don't hear anything from the guys(after waiting 1 week)
that maintain these web sites listed below they will all be removed from
the official apache mirrors list.

http://gd.tuwien.ac.at/infosys/servers/http/apache/dist/
http://www.fokus.gmd.de/apache/dist/httpd/
http://ftp.heanet.ie/mirrors/www.apache.org/dist/
http://apache.fresh.co.il/dist/
http://apache.happysize.co.jp/
http://mirror.nucba.ac.jp/mirror/apache/dist/ - Apache 1.3.14
http://elfas.kauko.lt/dist/ - Apache 1.3.23
http://myapache.i-ownur.info/
http://sunsite.icm.edu.pl/apache/dist/ - Apache 1.3.9
http://apache.chg.ru/dist/ - Apache 1.3.22
http://apache.en.com.sg/
http://apache.siol.net/dist/ - Apache 1.3.4( this guy wins the for
oldest verion of apache running on a mirror site)
http://noc.cvaix.com/mirrors/apache/
http://www.apache.inetcosmos.org/dist/ - Apache 1.3.19
http://apache.insync.za.net/ - Apache 1.3.22
http://apache.mirrorcentral.com/dist/ - Apache 1.3.23
http://apache.ttlhost.com/ - Apache 1.3.23
http://mirrors.ccs.neu.edu/Apache/dist/ - Apache 1.3.14