I'm not sure if I'm missing anything here, but is it intended that webapps should not be accessible from anywhere but localhost by default?

<Directory /usr/share/name> AllowOverride Options <IfModule mod_authz_core.c> # Apache 2.4 Require local </IfModule> </Directory>

Which pretty clearly disallows access from anywhere but localhost. It seems an odd default configuration, in that if you ever want to allow anyone to actually access your webapp you're going to have to change it, which will prevent it ever being automatically updated again

On Sat, Jul 20, 2013 at 3:53 PM, Adam Williamson <awilliam(a)redhat.com&gt; wrote: > I'm not sure if I'm missing anything here, but is it intended that > webapps should not be accessible from anywhere but localhost by default? > This seems to be the case for at least wordpress - which is my kind of > 'gold standard' for webapp packaging on Fedora, I use it as a reference > - and roundcubemail. They both have this block in > their /etc/httpd/conf.d/name.conf file: > > <Directory /usr/share/name> > AllowOverride Options > <IfModule mod_authz_core.c> > # Apache 2.4 > Require local > </IfModule> > <IfModule !mod_authz_core.c> > # Apache 2.2 > Order Deny,Allow > Deny from All > Allow from 127.0.0.1 > Allow from ::1 > </IfModule> > </Directory> > > Which pretty clearly disallows access from anywhere but localhost. It > seems an odd default configuration, in that if you ever want to allow > anyone to actually access your webapp you're going to have to change it, > which will prevent it ever being automatically updated again (you'll > always get a .rpmnew file). I have to change the 'Require local' to > 'Require all granted' and restart httpd in order to actually let > anything but localhost access the site. It's a vastly safer initial setup than leaving it wide open, by default. this applies to many tools such as Nagios and cacti, that may share information about your system that you really should review before exposing. You should also be albe to use a reload, not necessarily a restart, to get it working. (Although I've not been trying this with systemd!)

Am 20.07.2013 22:59, schrieb Adam Williamson: >> You should also be albe to use a reload, not necessarily a restart, to >> get it working. (Although I've not been trying this with systemd!) > > 'apachectl reload' didn't seem to do the job. because it does not exist "apachectl graceful" or "systemctl reload http.service" http://httpd.apache.org/docs/2.2/programs/apachectl.html [root@srv-rhsoft:~]$ apachectl reload Usage: /usr/sbin/httpd [-D name] [-d directory] [-f file] [-C "directive"] [-c "directive"] [-k start|restart|graceful|graceful-stop|stop] [-v] [-V] [-h] [-l] [-L] [-t] [-T] [-S] [-X] > It's a 'safer' default in the same way that a computer that's turned off > is safer than one that's turned on, I guess...though I suppose lots of > webapps do have initial configuration that you want to make sure is not > run remotely, obviously. But it does leave the rpmnew problem besides that these are config *examples* and not for production means they should not be overwritten after configuration: /etc/httpd/conf.d/z-name-allow.conf <Directory /usr/share/name> whatever you need to override </Directory>

On Sat, 2013-07-20 at 23:07 +0200, Reindl Harald wrote: > > Am 20.07.2013 22:59, schrieb Adam Williamson: >>> You should also be albe to use a reload, not necessarily a restart, to >>> get it working. (Although I've not been trying this with systemd!) >> >> 'apachectl reload' didn't seem to do the job. > > because it does not exist > > "apachectl graceful" or "systemctl reload http.service" > http://httpd.apache.org/docs/2.2/programs/apachectl.html > > >> It's a 'safer' default in the same way that a computer that's turned off >> is safer than one that's turned on, I guess...though I suppose lots of >> webapps do have initial configuration that you want to make sure is not >> run remotely, obviously. But it does leave the rpmnew problem > > besides that these are config *examples* and not for production > means they should not be overwritten after configuration: > > /etc/httpd/conf.d/z-name-allow.conf > <Directory /usr/share/name> > whatever you need to override > </Directory> If they are intended as examples they should be packaged as such; they are not

I do agree that the .rpmnew thing is annoying, and I wish there was a better way to handle that.

On Mon, Jul 22, 2013 at 01:16:30AM -0600, Ken Dreyer wrote: > I do agree that the .rpmnew thing is annoying, and I wish there was a > better way to handle that. I think in general, packaging webapps into RPM is of low value. I've tried to use these packages in production several times over the years, and inevitably become frustrated and which I'd just installed from upstream as upstream expects.

I'm not sure if I'm missing anything here, but is it intended that webapps should not be accessible from anywhere but localhost by default?

On Sun, Jul 21, 2013 at 6:47 PM, Jared K. Smith <jsmith(a)fedoraproject.org&gt; wrote: > On Sat, Jul 20, 2013 at 12:53 PM, Adam Williamson <awilliam(a)redhat.com&gt; > wrote: >> >> I'm not sure if I'm missing anything here, but is it intended that >> webapps should not be accessible from anywhere but localhost by default? > > > That's my understanding, yes. It follows from the general understanding > that network-accessible daemons (with perhaps the exception of sshd) should > not be accessible from outside of localhost by default. > > Now I'm curious... do you have a particularly strong reason why web apps > should be different than any other network daemon? Because they aren't. The daemon in this case is httpd, not the webapps

On Sun, Jul 21, 2013 at 07:39:50PM +0200, drago01 wrote: > On Sun, Jul 21, 2013 at 6:47 PM, Jared K. Smith > <jsmith(a)fedoraproject.org&gt; wrote: > > On Sat, Jul 20, 2013 at 12:53 PM, Adam Williamson > <awilliam(a)redhat.com&gt; > > wrote: > >> > >> I'm not sure if I'm missing anything here, but is it intended that > >> webapps should not be accessible from anywhere but localhost by > default? > > > > > > That's my understanding, yes. It follows from the general > understanding > > that network-accessible daemons (with perhaps the exception of sshd) > should > > not be accessible from outside of localhost by default. > > > > Now I'm curious... do you have a particularly strong reason why web > apps > > should be different than any other network daemon? > > Because they aren't. The daemon in this case is httpd, not the webapps. I guess each web app increases the attack surface (versus just httpd serving only flat files). Returning to the .rpmnew point, isn't it possible to have the web service include an alternative configuration file which would override the defaults? That way the "pristine" configuration file from RPM would be unchanged, and therefore upgradable.

On Sun, 2013-07-21 at 09:47 -0700, Jared K. Smith wrote: > Now I'm curious... do you have a particularly strong reason why web > apps should be different than any other network daemon? Not really, it just seemed odd, but after thinking about it a bit more the reasons are valid. It might be nice if this was explicitly explained somewhere, though, and Harald's suggestion of using separate files to override the values in the shipped config files was explained; perhaps a README file in /etc/httpd/conf.d?