4 ms·

This is mod_status, one of the modules Apache ships with. Why is this worrying? Here's the same thing for apache.og: http://www.apache.org/server-status http:/

This is mod_status, one of the modules Apache ships with. Why is this worrying? Here's the same thing for apache.og: http://www.apache.org/server-status http://www.apache.org/server-status

codeka 14y ago
I'd say it worrying that its open to the whole internet. Usually when I've used mod_status, its been password-protected.
- rll 14y ago
  We have looked at password-protecting it in the past, but it is useful for debugging and unless we SSL it the act of password-protecting with a simple basic auth would actually be more troubling than simply not because people get lazy with their passwords. We never saw a concrete security reason for locking it down. If you are worried about people seeing your IP as you browse, then you need to take other steps because your IP is spread across web server log files all over the Internet and you have no control over who has access to those. I'd suggest using Tor if you find this worrying.
  - codeka 14y ago
    Security is all about trade-offs. When I've used mod_status, I've just used a simple username and password that everybody shared. I've also served it from a different URL than the "well-known" /server-status. I realise that the IP addresses it shows are not on the order of credit card numbers, and its only the IP addresses at that particular instant (as opposed to historical data or something), but there is a difference between my IP address being logged in server logs and my IP address being visible to anyone who happens to visit a popular website at the same time as I do. Edit: what I'm saying is, its very easy to keep this information invisible from the open internet. I can see no advantages and only potential problems leaving it open. Given that, it seems like the prudent thing to do is to close it off.
  - tingletech 14y ago
    If you worked for the state of California (or an organization that has a policy to follow all CA government code even when it does not technically apply to them) then you have to consider an IP address a "network location" and must treat it as potentially personally identifying information. We only keep IP addresses for 30 days, and try to never share those IP addresses with third parties.
  - drivebyacct2 14y ago
    Exposing URLs doesn't seem appropriate.
nacs 14y ago
1) It provides a plethora of information to potential hackers as they can see literally every incoming request and can find admin pages and such. 2) Exposes every visitor's IP and the URL they're visiting to everyone. If more sites did this people's browsing history day-to-day would be exposed. Also as someone mentioned above, this is clearly a bad configuration issue -- this page is supposed to be password protected or IP restricted (to localhost by default in Apache). At the very least, the visitor IPs need to be masked.
- rll 14y ago
  1) Every piece of code on that box is open source. Security-through-obscurity hoping people won't find your admin pages is senseless. 2) There are far more effective ways of tracking users' browsing history than trying to scrape extremely ephemeral data like what you can find on the Apache status page. As someone mentioned, even the Apache project themselves leave this open.
  - chris_wot 14y ago
    He said IP restricted or password protected. That's not "security through obscurity".
    - X-Istence 14y ago
      And he is responding to the "finding admin pages or urls".
      - chris_wot 14y ago
        Actually, he said "admin pages and such".
peterwwillis 14y ago
As a security hacker, I always enjoy when servers leak juicy tidbits like version numbers, PID numbers, timing information, load use, client/server IPs, configuration of the webserver's limits, vhosts served, URLs served, TLS stats.... It's a treasure trove.

This is mod_status, one of the modules Apache ships with. Why is this worrying? Here's the same thing for apache.og: http://www.apache.org/server-status http://www.apache.org/server-status

codeka 14y ago

I'd say it worrying that its open to the whole internet. Usually when I've used mod_status, its been password-protected.

rll 14y ago
We have looked at password-protecting it in the past, but it is useful for debugging and unless we SSL it the act of password-protecting with a simple basic auth would actually be more troubling than simply not because people get lazy with their passwords. We never saw a concrete security reason for locking it down. If you are worried about people seeing your IP as you browse, then you need to take other steps because your IP is spread across web server log files all over the Internet and you have no control over who has access to those. I'd suggest using Tor if you find this worrying.
- codeka 14y ago
  Security is all about trade-offs. When I've used mod_status, I've just used a simple username and password that everybody shared. I've also served it from a different URL than the "well-known" /server-status. I realise that the IP addresses it shows are not on the order of credit card numbers, and its only the IP addresses at that particular instant (as opposed to historical data or something), but there is a difference between my IP address being logged in server logs and my IP address being visible to anyone who happens to visit a popular website at the same time as I do. Edit: what I'm saying is, its very easy to keep this information invisible from the open internet. I can see no advantages and only potential problems leaving it open. Given that, it seems like the prudent thing to do is to close it off.
- tingletech 14y ago
  If you worked for the state of California (or an organization that has a policy to follow all CA government code even when it does not technically apply to them) then you have to consider an IP address a "network location" and must treat it as potentially personally identifying information. We only keep IP addresses for 30 days, and try to never share those IP addresses with third parties.
- drivebyacct2 14y ago
  Exposing URLs doesn't seem appropriate.

nacs 14y ago

1) It provides a plethora of information to potential hackers as they can see literally every incoming request and can find admin pages and such. 2) Exposes every visitor's IP and the URL they're visiting to everyone. If more sites did this people's browsing history day-to-day would be exposed. Also as someone mentioned above, this is clearly a bad configuration issue -- this page is supposed to be password protected or IP restricted (to localhost by default in Apache). At the very least, the visitor IPs need to be masked.

rll 14y ago
1) Every piece of code on that box is open source. Security-through-obscurity hoping people won't find your admin pages is senseless. 2) There are far more effective ways of tracking users' browsing history than trying to scrape extremely ephemeral data like what you can find on the Apache status page. As someone mentioned, even the Apache project themselves leave this open.
- chris_wot 14y ago
  He said IP restricted or password protected. That's not "security through obscurity".
  - X-Istence 14y ago
    And he is responding to the "finding admin pages or urls".
    - chris_wot 14y ago
      Actually, he said "admin pages and such".

peterwwillis 14y ago

As a security hacker, I always enjoy when servers leak juicy tidbits like version numbers, PID numbers, timing information, load use, client/server IPs, configuration of the webserver's limits, vhosts served, URLs served, TLS stats.... It's a treasure trove.