Anonymization of public http://*.apache.org/server-status data

[William A Rowe Jr <wr...@rowe-clan.net>]

Somewhat simple rule, more complexity could be introduced...

<Location /server-status>
    SetHandler server-status

    <If "%{CONN_REMOTE_ADDR} != '127.0.0.1'">
        SetOutputFilter Sed
        OutputSed "s#<td>[^<]*</td><td nowrap>#<td>redacted</td><td
nowrap>#g"
    </If>
</Location>

This preserves the ability to locally probe server-status with wget to
diagnose what abusive client may be causing problems, but masks the Client
column in public fetches of server-status for anonymity and privacy
concerns.

Re: Anonymization of public http://*.apache.org/server-status data

[William A Rowe Jr <wr...@rowe-clan.net>]

On Thu, Oct 1, 2015 at 9:45 AM, William A Rowe Jr <wr...@rowe-clan.net>
wrote:

> Somewhat simple rule, more complexity could be introduced...
>
> <Location /server-status>
>     SetHandler server-status
>
>     <If "%{CONN_REMOTE_ADDR} != '127.0.0.1'">
>         SetOutputFilter Sed
>         OutputSed "s#<td>[^<]*</td><td nowrap>#<td>redacted</td><td
> nowrap>#g"
>     </If>
> </Location>
>
> This preserves the ability to locally probe server-status with wget to
> diagnose what abusive client may be causing problems, but masks the Client
> column in public fetches of server-status for anonymity and privacy
> concerns.
>

I was reminded that we once had a disclaimer on server-status which is now
missing, here is the mod_sed logic to inject it again without maintaining a
patch (feel free to adjust the text as desired);

        OutputSed "s#</h1>#</h1><p>This status is publicly exposed as an
illustration of an active server status page. Note that client IP addresses
are suppressed for privacy. <i>Reports to the security team that this page
is enabled will be ignored.</i></p>#"

Using lua it would be possible to write a more specific script that would
convert each REMOTE_ADDR into a simple 6 or 8 character hash to identify
abuse/requests from the same address without revealing the IPv4/IPv6
address.  Something to consider as a later enhancement.

Finally, I note that www.apache.org informs us;

Server Version: Apache/2.4.7 (Ubuntu) OpenSSL/1.0.1f

and people.apache.org is at;

Server Version: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1h DAV/2

All a number of years out-of-date.  Any particular reason for not picking
up 2.4.16 (at least, 2.2.30) and OpenSSL 1.0.1p already for their many
security fixes?