Hacker News Reader

Comment by dangrossman | Hacker News Reader

This is mod_status, one of the modules Apache ships with. Why is this worrying?

Here's the same thing for apache.og: http://www.apache.org/server-status

As a security hacker, I always enjoy when servers leak juicy tidbits like version numbers, PID numbers, timing information, load use, client/server IPs, configuration of the webserver's limits, vhosts served, URLs served, TLS stats....

It's a treasure trove.

I'd say it worrying that its open to the whole internet. Usually when I've used mod_status, its been password-protected.

We have looked at password-protecting it in the past, but it is useful for debugging and unless we SSL it the act of password-protecting with a simple basic auth would actually be more troubling than simply not because people get lazy with their passwords.

We never saw a concrete security reason for locking it down. If you are worried about people seeing your IP as you browse, then you need to take other steps because your IP is spread across web server log files all over the Internet and you have no control over who has access to those. I'd suggest using Tor if you find this worrying.

If you worked for the state of California (or an organization that has a policy to follow all CA government code even when it does not technically apply to them) then you have to consider an IP address a "network location" and must treat it as potentially personally identifying information. We only keep IP addresses for 30 days, and try to never share those IP addresses with third parties.

Security is all about trade-offs. When I've used mod_status, I've just used a simple username and password that everybody shared. I've also served it from a different URL than the "well-known" /server-status.

I realise that the IP addresses it shows are not on the order of credit card numbers, and its only the IP addresses at that particular instant (as opposed to historical data or something), but there is a difference between my IP address being logged in server logs and my IP address being visible to anyone who happens to visit a popular website at the same time as I do.

Edit: what I'm saying is, its very easy to keep this information invisible from the open internet. I can see no advantages and only potential problems leaving it open. Given that, it seems like the prudent thing to do is to close it off.

Exposing URLs doesn't seem appropriate.

1) It provides a plethora of information to potential hackers as they can see literally every incoming request and can find admin pages and such.

2) Exposes every visitor's IP and the URL they're visiting to everyone. If more sites did this people's browsing history day-to-day would be exposed.

Also as someone mentioned above, this is clearly a bad configuration issue -- this page is supposed to be password protected or IP restricted (to localhost by default in Apache). At the very least, the visitor IPs need to be masked.

1) Every piece of code on that box is open source. Security-through-obscurity hoping people won't find your admin pages is senseless.

2) There are far more effective ways of tracking users' browsing history than trying to scrape extremely ephemeral data like what you can find on the Apache status page. As someone mentioned, even the Apache project themselves leave this open.

He said IP restricted or password protected. That's not "security through obscurity".

And he is responding to the "finding admin pages or urls".

Actually, he said "admin pages and such".

Reply on news.ycombinator.com