Subject: function file in SSLRequire

From: Aumont <[email-masked]>
Date: Wed, 10 Apr 2002 15:36:45 +0200

Hi,

I try to use the SSLrequire directive using the expr
%{SSL_CLIENT_S_DN_Email} in {file("/some/file")}

Unfortunately, "file()" function is intended to return a single
value, not a comma separated list of value. 
My need is to control access to a enumerated list of personn. I
don't want to change httpd.conf (nor any included file).

What's the best method to do this ?
-- 
-----------------------------------------------------------
Serge Aumont        Comité Réseaux des Universités
                     Campus Beaulieu 
                     35042 Rennes Cedex
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: [email-masked]
Date: Wed, 10 Apr 2002 08:21:22 -0700 (PDT)

What are the issues with using a newer mod_ssl with an older apache?

I need to use Apache 1.3.12 for a project and am wondering if I can use
the newer mod_ssl releases?  Are there bugs or vulnerabilities with the
mod_ssl for Apache 1.3.12 or is it safe to use the older mod_ssl?

---

From: "Jeff" <[email-masked]>
Date: Thu, 11 Apr 2002 17:52:07 +1000

http://www.modssl.org/docs/2.8/ssl_faq.html#ToC5

quote: "And this also means you only can apply this mod_ssl version to
exactly this Apache version "

Regards
Jeff

---

From: Owen Boyle <[email-masked]>
Date: Thu, 11 Apr 2002 10:18:14 +0200

> mod_ssl for Apache 1.3.12 or is it safe to use the older mod_ssl?

AFAIK, mod_ssl is tweaked with every new apache version. If you look on
the mod_ssl site you will see that each distro is tagged with the apache
version to which it applies. I would not expect mod_ssl-2.8.8-1.3.24 to
work with apache 1.3.12.

Why do you need to use 1.3.12? If your binary was not compiled with EAPI
(needed for mod_ssl) you will need to recompile anyway.

Rgds,

Owen Boyle.

---

From: Cliff Woolley <[email-masked]>
Date: Thu, 11 Apr 2002 10:04:56 -0400 (EDT)

> What are the issues with using a newer mod_ssl with an older apache?

First of all, it would be difficult to get the patches to apply without
heavy manual assistance.

> mod_ssl for Apache 1.3.12 or is it safe to use the older mod_ssl?

Secondly, there are both bugs and (relatively minor) vulnerabilities in
older versions of both mod_ssl and Apache.

--Cliff