You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Sa...@seagate.com on 2003/03/07 00:12:55 UTC
[users@httpd] dynamic vs static module - security issues
Hi All,
Are there any security issues/concerns with including modules statically vs
dynamically? Are statically compiled modules more secure than dynamically
included modules?
Thanks
In Peace,
Saqib Ali
"I fear, if I rebel against my Lord, the retribution of an Awful Day (The
Day of Resurrection)" Al-Quran 6:15
http://www.seagate.cc/blog/
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] dynamic vs static module - security issues
Posted by Chris Taylor <ch...@x-bb.org>.
Well, if your box is compromised.......the attacker would be able to do
pretty much what they like, so substituing a dynamic module for dummy code
would be possible.....in theory.
However, I don't think it's makes the slightest bit of difference unless
that was to happen :)
HTH,
Chris Taylor - chris@x-bb.org - The guy with the PS2 WebServer -
http://www.x-bb.org/chris.asc
----- Original Message -----
From: <Sa...@seagate.com>
To: <us...@httpd.apache.org>
Sent: Thursday, March 06, 2003 11:12 PM
Subject: [users@httpd] dynamic vs static module - security issues
> Hi All,
>
> Are there any security issues/concerns with including modules statically
vs
> dynamically? Are statically compiled modules more secure than dynamically
> included modules?
>
> Thanks
>
> In Peace,
> Saqib Ali
> "I fear, if I rebel against my Lord, the retribution of an Awful Day (The
> Day of Resurrection)" Al-Quran 6:15
> http://www.seagate.cc/blog/
>
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] dynamic vs static module - security issues
Posted by Kevin Robert Casey <kr...@inetwebz.com>.
> Frankly though if your machine is compromised there are a lot of other
> things the bad guys are going to do rather than adding a re-written apache
> module. You probably want to worry more about kernel modules and root
> kits. A good practice (if this type of thing concerns you and it should)
> is to use something like Tripwire or Aide or even a home grown data base
> of crypto graphic hashes of key files (inluding modules, kernel or apache)
> and compare hashes on some regular basis.
at the risk of plugging something, i'd recommend using monit
(http://www.tildeslash.com/monit). not only can restart services that die
for whatever reason, it can perform checksum comparisons. you can set it to
compare a hardcoded checksum in the config file, or it will calculate it at
startup and continually compare it to that value.
just my two cents.
kevin
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] dynamic vs static module - security issues
Posted by Tim Wort <ti...@pobox.com>.
As others have noted, the short answer yes, dynamic is less secure than
static modules assuming, of course, you compiled with a known secure set
of modules to start with.
Frankly though if your machine is compromised there are a lot of other
things the bad guys are going to do rather than adding a re-written apache
module. You probably want to worry more about kernel modules and root
kits. A good practice (if this type of thing concerns you and it should)
is to use something like Tripwire or Aide or even a home grown data base
of crypto graphic hashes of key files (inluding modules, kernel or apache)
and compare hashes on some regular basis.
>From a security point of view, I might be concerned about the SOURCE that
I get modules from. If you trust the distribution site you should still
use the checksum files that most sites provide. Your chances of
downloading a module that is compromised and adding it to your system is
probably more likely than the system being compromised and a module
replaced. Consider that the Tripwire, TCP Wrappers and even monkeys.org
(DSNIFF hacking/security tool) have all be compromised and backdoors added
to the downloadable software over the years, all fixed now of course but
still... food for thought.
On Thu, 6 Mar 2003 Saqib.N.Ali@seagate.com wrote:
> Hi All,
>
> Are there any security issues/concerns with including modules statically vs
> dynamically? Are statically compiled modules more secure than dynamically
> included modules?
>
> Thanks
>
> In Peace,
> Saqib Ali
> "I fear, if I rebel against my Lord, the retribution of an Awful Day (The
> Day of Resurrection)" Al-Quran 6:15
> http://www.seagate.cc/blog/
>
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
>
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
= Inkling Research Inc. =
= Tim.Wort@InklingResearch.com =
= Tim.Wort@pobox.com =
= =
= Eschew Obfuscation =
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org