Subject: RE: Problems compiling mod_ssl with apache 2.0.44

From: "Boulytchev, Vasiliy" <[email-masked]>
Date: Fri, 7 Feb 2003 10:19:46 -0700

yes, I am positive, actually the clients that use FP extensions are positive, I am negative, but who listens to me these days.........

hehe

-----Original Message-----
From: R. DuFresne [mailto:[email-masked]]
Sent: Friday, February 07, 2003 9:46 AM
To: [email-masked]
Subject: RE: Problems compiling mod_ssl with apache 2.0.44

are you sure you wish to degrade the security of your apache  server with
front[age extensions?  Frontpage and coldfusion have a nasty security
history.

Thanks,

Ron DuFresne

On Fri, 7 Feb 2003, Boulytchev, Vasiliy wrote:

> This is off the modssl track, but has anyone gotten frontpage extensions working for httpd-2.0.44?   2.0.40 is the supported version, and the install quits if that is not it.  Just checking....   
> 
> 
> -----Original Message-----
> From: Sasa STUPAR [mailto:[email-masked]]
> Sent: Friday, February 07, 2003 2:39 AM
> To: [email-masked]
> Subject: Re: Problems compiling mod_ssl with apache 2.0.44
> 
> 
> I have just succesfully compiled apache 2.0.44 with mod_ssl and openssl
> 0.9.7 on RH8. First I have compiled openssl then apache and everything
> works fine. On trick after make install in openssl it doesn't copy
> headers so you have to manually copy them to your install directory.
> 
> On 2/7/2003 10:25 AM, Erik Melkersson a écrit:
> > Hi!
> > 
> > Thanks for the reply.
> > 
> > Geoff Thorpe wrote:
> >> ... The kind of linker
> >> error you report usually suggests the code was compiled against one
> >> openssl version's headers, but is trying to link against a different
> >> openssl version's libraries....
> > 
> > Yes, I tried to compile it against different openssl-version and didn't 
> > make clean in betweend (dumb fault by me)
> > 
> > After cleaning and compiling again we get some other errors.
> > undefined reference to OPENSSL_free, RAND_egd and RAND_status (se below 
> > for complete data)
> > 
> > In order to make apache compile we
> > - changed OPENSSL_free to CRYPTO_free in a #define in the modules/ssl/ 
> > headers file. (As that is done in openssl anyway)
> > - commented out the 3+3 lines where RAND_egd and RAND_status are used in 
> > modules/ssl/ssl_engine_rand.c
> > 
> > Now we can compile and use it over ssl even though commenting out non 
> > working code is propably a bad thing to do.
> > 
> > 
> > ./configure --prefix=/service/apache2 
> > --exec-prefix=/service/apache2/arch/linux-intel --enable-ssl 
> > --with-openssl=/service/apache2/openssl/
> > ...lots of rows...
> > make
> > ...lots of rows...
> > /bin/sh /usr/local/service/apache2/src/httpd-2.0.44/srclib/apr/libtool 
> > --mode=link gcc  -g -O2 -pthread    -DLINUX=2 -D_REENTRANT 
> > -D_XOPEN_SOURCE=500 -D_BSD_SOURCE -D_SVID_SOURCE 
> > -DAP_HAVE_DESIGNATED_INITIALIZER 
> > -I/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr/include 
> > -I/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr-util/include 
> > -I/service/apache2/openssl/include 
> > -I/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr-util/xml/expat/lib 
> > -I. -I/usr/local/service/apache2/src/httpd-2.0.44/os/unix 
> > -I/usr/local/service/apache2/src/httpd-2.0.44/server/mpm/prefork 
> > -I/usr/local/service/apache2/src/httpd-2.0.44/modules/http 
> > -I/usr/local/service/apache2/src/httpd-2.0.44/modules/filters 
> > -I/usr/local/service/apache2/src/httpd-2.0.44/modules/proxy 
> > -I/usr/local/service/apache2/src/httpd-2.0.44/include 
> > -I/usr/local/ssl/include/openssl -I/usr/local/ssl/include 
> > -I/usr/local/service/apache2/src/httpd-2.0.44/modules/dav/main 
> > -export-dynamic 
> > -L/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr-util/xml/expat/lib 
> > -L/usr/local/ssl/lib   -o httpd  modules.lo  modules/aaa/mod_access.la 
> > modules/aaa/mod_auth.la modules/filters/mod_include.la 
> > modules/loggers/mod_log_config.la modules/metadata/mod_env.la 
> > modules/metadata/mod_setenvif.la modules/ssl/mod_ssl.la 
> > modules/http/mod_http.la modules/http/mod_mime.la 
> > modules/generators/mod_status.la modules/generators/mod_autoindex.la 
> > modules/generators/mod_asis.la modules/generators/mod_cgi.la 
> > modules/mappers/mod_negotiation.la modules/mappers/mod_dir.la 
> > modules/mappers/mod_imap.la modules/mappers/mod_actions.la 
> > modules/mappers/mod_userdir.la modules/mappers/mod_alias.la 
> > modules/mappers/mod_so.la server/mpm/prefork/libprefork.la 
> > server/libmain.la os/unix/libos.la -lssl -lcrypto 
> > /usr/local/service/apache2/src/httpd-2.0.44/srclib/pcre/libpcre.la 
> > /usr/local/service/apache2/src/httpd-2.0.44/srclib/apr-util/libaprutil-0.la 
> > -lgdbm -ldb 
> > /usr/local/service/apache2/src/httpd-2.0.44/srclib/apr-util/xml/expat/lib/libexpat.la 
> > /usr/local/service/apache2/src/httpd-2.0.44/srclib/apr/libapr-0.la -lm 
> > -lcrypt -lnsl -lresolv -ldl
> > modules/ssl/.libs/mod_ssl.al(ssl_engine_kernel.lo): In function 
> > `ssl_hook_UserCheck':
> > /usr/local/service/apache2/src/httpd-2.0.44/modules/ssl/ssl_engine_kernel.c:875: 
> > undefined reference to `OPENSSL_free'
> > modules/ssl/.libs/mod_ssl.al(ssl_engine_kernel.lo): In function 
> > `ssl_callback_SSLVerify':
> > /usr/local/service/apache2/src/httpd-2.0.44/modules/ssl/ssl_engine_kernel.c:1206: 
> > undefined reference to `OPENSSL_free'
> > /usr/local/service/apache2/src/httpd-2.0.44/modules/ssl/ssl_engine_kernel.c:1210: 
> > undefined reference to `OPENSSL_free'
> > modules/ssl/.libs/mod_ssl.al(ssl_engine_kernel.lo): In function 
> > `ssl_callback_SSLVerify_CRL':
> > /usr/local/service/apache2/src/httpd-2.0.44/modules/ssl/ssl_engine_kernel.c:1469: 
> > undefined reference to `OPENSSL_free'
> > modules/ssl/.libs/mod_ssl.al(ssl_engine_kernel.lo): In function 
> > `modssl_proxy_info_log':
> > /usr/local/service/apache2/src/httpd-2.0.44/modules/ssl/ssl_engine_kernel.c:1507: 
> > undefined reference to `OPENSSL_free'
> > modules/ssl/.libs/mod_ssl.al(ssl_engine_rand.lo): In function 
> > `ssl_rand_seed':
> > /usr/local/service/apache2/src/httpd-2.0.44/modules/ssl/ssl_engine_rand.c:125: 
> > undefined reference to `RAND_egd'
> > /usr/local/service/apache2/src/httpd-2.0.44/modules/ssl/ssl_engine_rand.c:163: 
> > undefined reference to `RAND_status'
> > modules/ssl/.libs/mod_ssl.al(ssl_engine_vars.lo): In function 
> > `ssl_var_lookup_ssl_cert':
> > /usr/local/service/apache2/src/httpd-2.0.44/modules/ssl/ssl_engine_vars.c:351: 
> > undefined reference to `OPENSSL_free'
> > 
> > Machine running Linux 2.2.17-14smp (RedHat 6.2)
> > openssl 0.9.7
> > apache 2.0.44
> > 
> 
> 
> ______________________________________________________________________
> Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
> User Support Mailing List                      [email-masked]
> Automated List Manager                            [email-masked]
> ______________________________________________________________________
> Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
> User Support Mailing List                      [email-masked]
> Automated List Manager                            [email-masked]
> 

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Boulytchev, Vasiliy" <[email-masked]>
Date: Fri, 7 Feb 2003 12:51:45 -0700

I walked around the setups, and it works beautifully,  the only thing I changed was the ./configure script in /usr/src/apache.blah/ to look in the correct folders for my ssl stuff.  

-----Original Message-----
From: Sasa STUPAR [mailto:[email-masked]]
Sent: Friday, February 07, 2003 11:59 AM
To: [email-masked]
Subject: Re: Problems compiling mod_ssl with apache 2.0.44

No, It doesn't. I have compiled it with prefix /usr/include and
openssldir /usr/include/openssl and there are no headers. I haven't
noticed it on first but when I wanted to compile apache with mod_ssl it
returns an error that it was unable to find headers for ssl.
Is there someone else reporting the same problem ? Maybe is this related
to the RedHat8 distrubution only.

Sasa

On 2/7/2003 7:17 PM, Geoff Thorpe a écrit:
> * Sasa STUPAR ([email-masked]) wrote:
> It doesn't? It certainly should - can you please double-check this and
> report the details to me if it's true? Noone (to my knowledge) has
> reported this problem and openssl 0.9.7 has been through a fairly
> extensive beta testing period (during which the header installation
> didn't AFAICS require any hacking).
> 
> Cheers,
> Geoff
>

---

From: [email-masked]
Date: Mon, 10 Feb 2003 11:20:06 -0000

> From: Geoff Thorpe [mailto:[email-masked]]
> Sent: 08 February 2003 18:08
> > Ok, I have found the problem. If you want to have files in the same
> > directories as original instalation of RH8 you have to use "./config
> > --prefix=/usr". Sorry for that confusion. It is the 
> distribution which
> > is strange.
> 
> Phew, I was starting to wonder what I was missing here :-) As I
> mentioned originally, using "/usr/include" as an installation prefix
> doesn't make sense because it will create the standard 
> {include,bin,man}
> tree beneath that and install. Hence "/usr" or "/usr/local" make more
> sense. Also, especially on package management systems like RH, you're
> better not to simply install *over* existing files, particularly as a
> newer version of openssl may have removed headers that were in a
> previous version, so the old ones will end up mixed up with the new
> ones. And of course if a bug-fix release is made by RH to the older
> version, eg. 0.9.6x, that could seriously screw things up if you'd
> installed 0.9.7 over the top. It could also totally mangle 
> your system's
> RPM database, and various other carnage is possible.
> 
> The solution is to either grapple with RH's dependencies to try and
> build a replacement openssl RPM from source to upgrade to (which many
> will tell you is an only slightly less difficult problem than the
> alchemy of gold itself) or to install openssl elsewhere and make sure
> your system paths are organised appropriately. Eg. you could use
> /usr/local or /opt as a place to manually install packages such as a
> newer openssl, and make sure that the bin subdirectory is earlier in
> PATH than /usr/bin, ditto for the lib subdirectory in /etc/ld.so.conf,
> the man subdirectory in /etc/man.config, and so on ...
> 
Actually, it shouldn't make any difference to the installed RPM of
openssl-0.9.6b, provided that /usr/bin/openssl isn't overwritten. The
quickest way to check is with "rpm -V openssl", which should return no
response. All your other points above are valid though. It is probably best
though to put newer stuff for Red Hat under /usr/local so you don't break
anything installed.

Now, upgrading openssl-0.9.6 on a Red Hat box (7.0-8.0 inclusive) will screw
things up  bigtime (see the specific section in the openssl FAQ).

If there's sufficient demand I'll make up an openssl 0.9.7 RPM for RedHat
users. So far no-one has asked...

- 
John Airey, BSc (Jt Hons), CNA, RHCE
Internet systems support officer, ITCSD, Royal National Institute of the
Blind,
Bakewell Road, Peterborough PE2 6XU,
Tel.: +44 (0) 1733 375299 Fax: +44 (0) 1733 370848 [email-masked] 

Am I the only person in the UK who finds it strange that our Prime Minister
complains of Human Rights abuses around the world, yet wishes to opt out of
the European Convention of Human Rights?

- 

NOTICE: The information contained in this email and any attachments is 
confidential and may be legally privileged. If you are not the 
intended recipient you are hereby notified that you must not use, 
disclose, distribute, copy, print or rely on this email's content. If 
you are not the intended recipient, please notify the sender 
immediately and then delete the email and any attachments from your 
system.

RNIB has made strenuous efforts to ensure that emails and any 
attachments generated by its staff are free from viruses. However, it 
cannot accept any responsibility for any viruses which are 
transmitted. We therefore recommend you scan all attachments.

Please note that the statements and views expressed in this email 
and any attachments are those of the author and do not necessarily 
represent those of RNIB.

RNIB Registered Charity Number: 226227

Website: http://www.rnib.org.uk