Re: mod_security for Apache -- WEB400

perhaps this should be raised with IBM at Common during soundoff.
There have been times when IBM offers more security in the win/unix
versions than in the similar "i" offering - and then says we should put that win/x stuff in front of our i for secure web serving.
It would truly s*** if a "i" web solution can't pass PCI compliance!
(unless the industry standard best practices PCI way of doing this is the external appliance?)

Jim Franz

----- Original Message ----- From: "Peter Connell" <Peter.Connell@xxxxxxxxxxxxxxxxx>
To: "Web Enabling the AS400 / iSeries" <web400@xxxxxxxxxxxx>
Sent: Tuesday, February 10, 2009 3:31 PM
Subject: Re: [WEB400] mod_security for Apache

It may come that if mod_security is the most expedient and viable option
but when it comes to a global security solution I prefer to have someone
to follow, not lead.

-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]
On Behalf Of Haas, Matt (CL Tech Sv)
Sent: Wednesday, 11 February 2009 9:02 a.m.
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] mod_security for Apache

But isn't that exactly what you're being asked to do?

Matt

-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]
On Behalf Of Peter Connell
Sent: Tuesday, February 10, 2009 1:27 PM
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] mod_security for Apache

Yes, one would hope that if was all so easy to take advantage of such a
frequently suggested security module then someone in the OS400 community
would have broken this ground some time ago. There is always some
apprehension in attempting to explain that the most significant gateway
for the enterprise is protected because I downloaded something from the
web.

-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]
On Behalf Of Haas, Matt (CL Tech Sv)
Sent: Wednesday, 11 February 2009 0:01
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] mod_security for Apache

You could also download and compile the module. I took a look at the
install documentation and they do not say you have to re-build Apache.
You could also likely use AIX binaries of this module (and its
dependencies). The InfoCenter has information on building additional
modules for the HTTP server.

Matt

-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]
On Behalf Of Nathan Andelin
Sent: Tuesday, February 10, 2009 6:53 AM
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] mod_security for Apache

From: Peter Connell
If IBM fail to provide a way to implement mod_security then the other
options are installing an application firewall in front ...

Well, at least you have that option.

One other thought that occurred to me was to try running an open-source
version of Apache under PASE - a version that has mod_security built-in,
as a proxy in front of the IBM i HTTP server. But I know little about
getting software to run under PASE.

Does Zend Core come with mod_security?

Nathan.

--
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list To
post a message email: WEB400@xxxxxxxxxxxx To subscribe, unsubscribe, or
change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives at
http://archive.midrange.com/web400.

--
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.

########################################################################
#############
This correspondence is for the named person's use only. It may contain
confidential or legally privileged information, or both. No
confidentiality or privilege is waived or lost by any mistransmission.
If you receive this correspondence in error, please immediately delete
it from your system and notify the sender. You must not disclose, copy
or rely on any part of this correspondence if you are not the intended
recipient. Any views expressed in this message are those of the
individual sender, except where the sender expressly, and with
authority, states them to be the views of Veda Advantage. If you need
assistance, please contact Veda Advantage on either :- Australia 133124
or New Zealand +64 9 367 6200
--
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.

--
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.

#####################################################################################
This correspondence is for the named person's use only. It may contain confidential or legally privileged information, or both. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this correspondence in error, please immediately delete it from your system and notify the sender. You must not disclose, copy or rely on any part of this correspondence if you are not the intended recipient. Any views expressed in this message are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of Veda Advantage. If you need assistance, please contact Veda Advantage on either :- Australia 133124 or New Zealand +64 9 367 6200
--
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.