Subject: mod_ssl, apache, cgi-bin, IE 5.5, & Mailman

From: David Gibbs <[email-masked]>
Date: Sun, 06 Jan 2002 13:11:15 -0600

Folks:

I'm having a problem getting mod_ssl to work in my Apache server running 
Mailman CGI programs.

I'm running RedHat 7.2, with Apache/1.3.22 & mod_ssl 2.8.4.

I have self-signed the certificates and the system seems to work fine when 
using Netscape.

For some reason, however, when I try to access the exact same pages with 
Internet Explorer (5.5), none of the cgi input is accepted ... it's just 
ignored.

The mailman interface uses POST to submit the data to the server.

I'm using the following SSL dirctives...

         SSLEngine on
         SSLCertificateFile /etc/httpd/conf/ssl.crt/lists.crt
         SSLCertificateKeyFile /etc/httpd/conf/ssl.key/lists.key
         CustomLog /var/log/httpd/mailman/ssl_request_log "%t %h 
%{SSL_PROTOCOL}x
  %{SSL_CIPHER}x \"%r\" %b"
         ScriptAlias /cgi-bin/ /home/mailman/cgi-bin/
         SSLOptions +FakeBasicAuth +ExportCertData +CompatEnvVars 
+StrictRequire

Any suggestions?

Thanks!

david

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "R. DuFresne" <[email-masked]>
Date: Sun, 6 Jan 2002 16:19:19 -0500 (EST)

I'd remove the mailman CGI scripts, they have some security issues that
have been covered on the Bugtraq list.

Thanks,

Ron DuFresne

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior consultant:  sysinfo.com
                  http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!

---

From: "Julian C. Dunn" <[email-masked]>
Date: Sun, 6 Jan 2002 17:38:41 -0500 (EST)

> have been covered on the Bugtraq list.

I really don't think that this is a very helpful comment because it's a
non-sequitur; first off it doesn't solve David's problem, and second of
all, you should provide some context for that statement. MailMan < 2.0.8
suffers from cross-site-scripting security problems which have been fixed
in the latest release, if those are the security issues you are referring
to. Even so, what if David is running MailMan on an intranet where the CSS
bugs won't be exploited? Then these security issues are not relevant to
him.

- Julian

---

From: "R. DuFresne" <[email-masked]>
Date: Sun, 6 Jan 2002 23:43:22 -0500 (EST)

> bugs won't be exploited? Then these security issues are not relevant to

First, I didn't think folks on this list required spoonfeeding.  I take it
that folks capble of untarring and going through the farily complex
instructions for installing 3 or more seperate packages are qualified to
do some research on their own, which persons concerned with the security
of the site<s> they maintain certainly should do, yes?  Second, I am not
aware, and you certainly are not aware of which version of mailman the
requestor has on his system.  Third, in a private response to the
requester, which I'll not post as it was indeed a private exchange and
the posting of private exchanges is in bad form, right?, there was a bit
more information included, to help guide them in their own search for the
issues breifly related in my first public posting.  Forth, you were and
are certainly allowed to supply more information and spoonfeeding to
requestors, should you feel it nessecary, as you did, for the edification
of the full list or privately, if spoonfeeding is your forte.

Thanks,

Ron DuFresne

---

From: David Gibbs <[email-masked]>
Date: Sun, 06 Jan 2002 22:47:57 -0600

At 11:43 PM 1/6/2002 -0500, you wrote:
>First, I didn't think folks on this list required spoonfeeding.

Folks:

Mailman isn't really the issue ... I am running 2.0.8, but I think the 
problem lies with IE & mod_ssl ... as Netscape works fine.

I've checked the FAQ's and done the requisite Google searches ... I 
couldn't find anything significant.

Is there any debugging flags that I can turn on to get more information, 
perhaps I have something configured wrong.  Maybe something has to be added 
to allow IE data to be accepted.

Thanks!

david

---

From: "R. DuFresne" <[email-masked]>
Date: Sun, 6 Jan 2002 23:56:58 -0500 (EST)

I hate to reply to my own postings, but, there is a fifth <non-alchoholic
of course> I forgot to mention.  Many of the CGI scripts one will find
posted for free use on the net are open vulnerabilities, and many of those
authors no longer maintain them.  For that reason, people are far better
off to learn a scripting language and the intricities of using it in a
secure fashion rather then relying upon what they might find, poorly if at
all maintained, on the free CGI sites. 

Thanks,

Ron DuFresne

---

From: "Julian C. Dunn" <[email-masked]>
Date: Mon, 7 Jan 2002 08:42:05 -0500 (EST)

> all maintained, on the free CGI sites.

What this has to do with the original poster's problem -- heck, what ANY
of your post has to do with the original poster's problem, or mod-ssl, is
totally beyond me. It looks like you are using this opportunity to go off
on a completely unrelated tangent about security problems and/or
cross-site-scripting vulnerabilities, when the likelihood of the original
poster's problem being attributed to these problems is extremely minimal.

Unless you have something to contribute in the mod-ssl context I suggest
you confine your security-related comments to an appropriate forum.

- Julian

---

From: "R. DuFresne" <[email-masked]>
Date: Mon, 7 Jan 2002 09:36:26 -0500 (EST)

as much help as you've offered the requestor eh?

My suggestion, send yer flamse to /dev/null, it'll pay you more attention.

Thanks,

Ron DuFresne

---

From: "Glen S Mehn" <[email-masked]>
Date: Mon, 7 Jan 2002 18:58:26 -0800

Hi David:

There's a FAQ on the mod_ssl site about IE and it's problems implementing
the protocol properly. The short answer is to add:

SetEnvIf User-Agent ".*MSIE.*" \
	nokeepalive ssl-unclean-shutdown \
	downgrade-1.0 force-response-1.0
SetEnv nokeepalive
SetEnv ssl-unclean-shutdown
SetEnv downgrade-1.0

in your :443 VirtualHost section. The longer, and worth-a-read answer is in
the FAQ.

glen

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of David Gibbs
Sent: Sunday, January 06, 2002 08:48 PM
To: [email-masked]
Subject: Re: mod_ssl, apache, cgi-bin, IE 5.5, & Mailman

Folks:

Thanks!

david