[B! Security][Apache] justoneplanetã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

justoneplanet id:justoneplanet

Securityã¨Apacheã«é–¢ã™ã‚‹justoneplanetã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

hashdosæ”»æ’ƒã‚’mod_securityã§é˜²å¾¡ã™ã‚‹(CentOS+yumç·¨)
ã“ã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯ã€hashdoså¯¾ç–ã¨ã—ã¦ã®mod_securityã®å°Žå…¥ã¨è¨å®šã®æ–¹æ³•ã‚’èª¬æ˜Žã—ã¾ã™ã€‚CentOSç’°å¢ƒã§yumã«ã‚ˆã‚ŠApacheã‚’å°Žå…¥ã—ã¦ã„ã‚‹ã‚µã‚¤ãƒˆã«å¯¾ã—ã¦ã€yumã«ã‚ˆã‚Šmod_securityã‚’å°Žå…¥ã™ã‚‹ã¨ã„ã†ã‚·ãƒŠãƒªã‚ªã§èª¬æ˜Žã—ã¾ã™ã€‚ ã¯ã˜ã‚ã«æ—¢ã«å½“ãƒ–ãƒã‚°ã§å ±å‘Šã®é€šã‚Šã€hashdosã¨å‘¼ã°ã‚Œã‚‹æ”»æ’ƒæ‰‹æ³•ãŒå…¬è¡¨ã•ã‚Œã¦ã„ã¾ã™ã€‚HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆã®ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿åã«å¯¾ã™ã‚‹ãƒãƒƒã‚·ãƒ¥å€¤ã‚’æ•…æ„ã«åŒä¸€ã«ã—ãŸ(è¡çªã•ã›ãŸ)ã‚‚ã®ã‚’å¤šæ•°ï¼ˆæ•°ä¸‡ç¨‹åº¦ï¼‰é€ä¿¡ã™ã‚‹ã“ã¨ã«ã‚ˆã‚Šã€Webã‚µãƒ¼ãƒãƒ¼ã‚’æ•°åˆ†ç¨‹åº¦éŽè² è·ã«ã§ãã‚‹ã¨ã„ã†DoSæ”»æ’ƒæ‰‹æ³•ã§ã™ã€‚ã¾ã hashdosã«ã‚ˆã‚‹æ”»æ’ƒäº‹ä¾‹ã¯å ±å‘Šã•ã‚Œã¦ã„ãªã„ã‚ˆã†ã§ã™ãŒã€æ—¢ã«æ”»æ’ƒã‚³ãƒ¼ãƒ‰ï¼ˆPoCï¼‰ãŒå…¬è¡¨ã•ã‚Œã¦ã„ã‚‹ãŸã‚ã€ã„ã¤æ”»æ’ƒãŒèµ·ã“ã£ã¦ã‚‚ä¸æ€è°ã§ã¯ãªã„çŠ¶æ³ã§ã™ã€‚ PHPã‚‚å½±éŸ¿ã‚’å—ã‘ã‚‹ãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ã§ã‚ã‚Šã€PHP5.3.9ã§å¯¾å‡¦äºˆå®šã¨ãªã£ã¦ã„ã¾ã™ãŒã€ã¾ã PHP5.3.9ã¯ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¦
justoneplanet 2012/01/09
security

Apache

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

mod_security

hashdos

php

centos

waf

yum
ãƒªãƒ³ã‚¯
DoSã®è„†å¼±æ€§ã‚’ä¿®æ£ã—ãŸã€ŒApache 2.2.20ã€ã€å…¬é–‹ ï¼ ï¼ IT
2011/08/31 Apache Software Foundationã¨Apache HTTP Server Projectã¯ç±³å›½æ™‚é–“ã®8æœˆ30æ—¥ã€ã‚µãƒ¼ãƒ“ã‚¹é‹ç”¨å¦¨å®³ï¼ˆDoSï¼‰ã®è„†å¼±æ€§ã‚’ä¿®æ£ã—ãŸã€ŒApache 2.2.20ã€ã‚’å…¬é–‹ã—ãŸã€‚ãŸã ã—ã€Apache 2.0ï¼1.3ç³»åˆ—ã«ã¤ã„ã¦ã¯ã€ä¿®æ£ç‰ˆã¯ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¦ã„ãªã„ã€‚ Apache HTTPDã‚µãƒ¼ãƒã«ã¤ã„ã¦ã¯ã€8æœˆ24æ—¥ã”ã‚ã‹ã‚‰ã€DoSæ”»æ’ƒã«ã¤ãªãŒã‚‹è„†å¼±æ€§ãŒæŒ‡æ‘˜ã•ã‚Œã¦ã„ãŸã€‚Rangeãƒ˜ãƒƒãƒ€ãŠã‚ˆã³Request-Rangeãƒ˜ãƒƒãƒ€ã®å‡¦ç†ã«å•é¡ŒãŒã‚ã‚‹ãŸã‚ã€ç´°å·¥ã‚’æ–½ã—ãŸãƒ‘ã‚±ãƒƒãƒˆã‚’é€ã‚Šä»˜ã‘ã‚‰ã‚Œã‚‹ã¨CPUã¨ãƒ¡ãƒ¢ãƒªãŒå¤§é‡ã«æ¶ˆè²»ã•ã‚Œã€ã‚µãƒ¼ãƒè‡ªä½“ã®æ“ä½œã‚„ã‚µãƒ¼ãƒ“ã‚¹æä¾›ãŒå›°é›£ãªçŠ¶æ…‹ã«é™¥ã‚‹ã€‚ å½±éŸ¿ã‚’å—ã‘ã‚‹ã®ã¯ã€Apache 1.3ç³»åˆ—ã®ã™ã¹ã¦ã€ãã‚Œã«Apache 2.0.64ï¼2.2.19ä»¥å‰ã®ã™ã¹ã¦ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã ã€‚æ‚ªã„ã“ã¨ã«ã€ã“ã®è„†å¼±æ€§ã‚’æ‚ªç”¨ã™ã‚‹æ”»æ’ƒãƒ„ãƒ¼ãƒ«ã€ŒA
justoneplanet 2011/09/01
apache

2.2

security
ãƒªãƒ³ã‚¯
Apache killerã¯å±é™ºï½žApache killerã‚’è©•ä¾¡ã™ã‚‹ä¸Šã§ã®æ³¨æ„ï½ž
Apacheã®è„†å¼±æ€§(CVE-2011-3192)ã„ã‚ã‚†ã‚‹Apache killerãŒè©±é¡Œã«ãªã£ã¦ã„ã¾ã™ãŒã€ãã®è„…å¨ã«ã¤ã„ã¦ã¯ä¸€éƒ¨èª¤è§£ãŒã‚ã‚‹ã‚ˆã†ã§ã™ã€‚ ä»¥ä¸‹ã¯ã€éžå¸¸ã«è„…å¨ã¨ã™ã‚‹å ±å‘Šã®ä¾‹ã§ã™ã€‚ ä¸€æ–¹ä»Šå›žã®ã¯ãƒ—ãƒã‚»ã‚¹ã®è‚¥å¤§åŒ–ã‚’ä¼´ã†ã®ã§ã€å®Ÿãƒ¡ãƒ¢ãƒªæ¶ˆè²»ã—ã¦æ›´ã«ã‚¹ãƒ¯ãƒƒãƒ—ã‚‚ä½¿ã„å°½ãã—ã¦OSæ¯Žæ¿€é‡ã«ãªã£ãŸã‚ã’ãLinuxã¨ã‹ã®å ´åˆã¯OOM Killerç™ºå‹•ã¨ã€ä»–ã®ãƒ—ãƒã‚»ã‚¹ã‚„å ´åˆã«ã‚ˆã£ã¦ã¯OSã‚’å·»ãè¾¼ã‚“ã§é€ã£ã¦ã—ã¾ã„ã¾ã™ã€‚ CVE-2011-3192 Range header DoS vulnerability Apache HTTPD 1.3/2.xã‚ˆã‚Šå¼•ç”¨ ä»¥ä¸‹ã¯ã€ãã‚Œã»ã©è„…å¨ã§ãªã‹ã£ãŸã¨ã™ã‚‹å ±å‘Šã®ä¾‹ã§ã™ã€‚ pooh.gr.jp ã¯çµæ§‹é ‘ä¸ˆã ã£ãŸã®ã§ 60 ä¸¦åˆ—ã§ã‚„ã£ã¨ CPU idle 30% ã¾ã§æ¸›ã‚‰ã›ãŸã€‚ Apache Killer (CVE-2011-3192) å¯¾ç– for CentOS 5
justoneplanet 2011/08/28
apache

è„†å¼±æ€§

security

Apache

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ç‰¹å®šã®ã‚µãƒ–ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã«åˆ¥ã®BASICèªè¨¼ã‚’ã‹ã‘ã‚‹ - Do You PHP ã¯ã¦ãƒ–ãƒ
BASICèªè¨¼ã®ã‹ã‹ã£ã¦ã„ã‚‹ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãŒã‚ã‚Šã€ãã®ã‚µãƒ–ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã«åˆ¥ã®BASICèªè¨¼ã‚’ã‹ã‘ãŸã„å ´åˆãŒã‚ã£ãŸã®ã§ãƒ¡ãƒ¢ã€‚ ãŸã¨ãˆã°ã€http://example.com/hoge/ ã«ã™ã§ã«BASICèªè¨¼ãŒã‹ã‘ã‚‰ã‚Œã¦ã„ã‚‹ãŒã€http://example.com/hoge/fuga/ ã«åˆ¥ã®BASICèªè¨¼ã€Œã ã‘ã€ã‚’ã‹ã‘ãŸã„ã€ã¨ã„ã£ãŸå ´åˆã§ã™ã€‚ ç°¡å˜ã«è€ƒãˆã‚‹ã¨ã€ãƒ‡ã‚£ãƒ¬ã‚¯ãƒ†ã‚£ãƒ–ã‚„ãƒ‡ã‚£ãƒ¬ã‚¯ãƒ†ã‚£ãƒ–ã‚’2ã¤ä¸¦ã¹ã‚Œã°ã†ã¾ãã„ããã†ãªã‚‚ã‚“ã§ã™ãŒã€ä¸¡æ–¹ã®èªè¨¼ãŒã‹ã‹ã£ã¦ã—ã¾ã„ã¾ã™ã€‚ ãã“ã§ã€ãƒ‡ã‚£ãƒ¬ã‚¯ãƒ†ã‚£ãƒ–ã¨ãƒ‡ã‚£ãƒ¬ã‚¯ãƒ†ã‚£ãƒ–ã®ä¸¡æ–¹ã‚’ä½¿ã†ã¨æœŸå¾…é€šã‚Šã«å‹•ä½œã—ã¾ã—ãŸã€‚å…·ä½“çš„ãªè¨å®šä¾‹ã¯æ¬¡ã®é€šã‚Šã€‚ <Location ~ "^/hoge/fuga"> AuthType Basic AuthUserFile /path/to/.htpasswd.fuga AuthName "Enter password for fuga" R
justoneplanet 2010/09/22
authentication

BASICèªè¨¼

htaccess

apache

security

ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒª
ãƒªãƒ³ã‚¯
1

ãŠçŸ¥ã‚‰ã›

ã‚‚ã£ã¨èªã‚€

å…¬å¼Twitter

@hatebu
æœ€æ–°ã®äººæ°—ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã®é…ä¿¡

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

jæ¬¡ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

kå‰ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

lã‚ã¨ã§èªã‚€

eã‚³ãƒ¡ãƒ³ãƒˆä¸€è¦§ã‚’é–‹ã

oãƒšãƒ¼ã‚¸ã‚’é–‹ã

è¨å®šã‚’å¤‰æ›´ã—ã¾ã—ãŸx

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (15)

Securityã¨Apacheã«é–¢ã™ã‚‹justoneplanetã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

ãŠçŸ¥ã‚‰ã›

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´3æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´3æœˆç¬¬5é€±ï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´3æœˆç¬¬4é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (15)

Securityã¨Apacheã«é–¢ã™ã‚‹justoneplanetã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

hashdosæ”»æ’ƒã‚’mod_securityã§é˜²å¾¡ã™ã‚‹(CentOS+yumç·¨)

DoSã®è„†å¼±æ€§ã‚’ä¿®æ­£ã—ãŸã€ŒApache 2.2.20ã€ã€å…¬é–‹ ï¼ ï¼ IT

Apache killerã¯å±é™ºï½žApache killerã‚’è©•ä¾¡ã™ã‚‹ä¸Šã§ã®æ³¨æ„ï½ž

ç‰¹å®šã®ã‚µãƒ–ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã«åˆ¥ã®BASICèªè¨¼ã‚’ã‹ã‘ã‚‹ - Do You PHP ã¯ã¦ãƒ–ãƒ­

ãŠçŸ¥ã‚‰ã›

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2025å¹´3æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2025å¹´3æœˆç¬¬5é€±ï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2025å¹´3æœˆç¬¬4é€±ï¼‰

å…¬å¼Twitter

ã‚­ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (15)

Securityã¨Apacheã«é–¢ã™ã‚‹justoneplanetã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

hashdosæ”»æ’ƒã‚’mod_securityã§é˜²å¾¡ã™ã‚‹(CentOS+yumç·¨)

DoSã®è„†å¼±æ€§ã‚’ä¿®æ£ã—ãŸã€ŒApache 2.2.20ã€ã€å…¬é–‹ ï¼ ï¼ IT

Apache killerã¯å±é™ºï½žApache killerã‚’è©•ä¾¡ã™ã‚‹ä¸Šã§ã®æ³¨æ„ï½ž

ç‰¹å®šã®ã‚µãƒ–ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã«åˆ¥ã®BASICèªè¨¼ã‚’ã‹ã‘ã‚‹ - Do You PHP ã¯ã¦ãƒ–ãƒ

ãŠçŸ¥ã‚‰ã›

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´3æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´3æœˆç¬¬5é€±ï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´3æœˆç¬¬4é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹