Prepackaged lophttpd for Android

Pre-packaged lophttpd Android binaries are available now.
They also feature a quiet mode, which forces lhttpd to
not write anything to disk, e.g. no logs and no generated
indexes.

lophttpd running on android

Eventually, lophttpd now also runs on Android!


The native non-JNI C++ support for Android really sucks,
since it is a hassle to get linked to the stdc++ lib
and some well known libc functions just do not exist
(such as ftw(3)). Nevertheless, it runs smooth now.
It only makes sense on rooted devices, but its somehow nice
for forensics, as lophttpd can serve block dev files
directly.
However, this is just a side-gig since lophttpd really wants
to run on big iron :)
I will provide prebuilt Android binaries soon.

lots of performance webserver

I made some git commits to lophttpd which is now no
longer poor, but lots of performance httpd (or lots of porn,
which is also 'static content').
lophttpd got an optional -B switch to specify a HTML base tag
which allows it to generate correct index files behind
reverse proxies.


The included experimental reverse proxy, frontend, with
load balancing included, should now also be usable for
first tests. At least my tests were successful.
Its not really documented yet (make -f Makefile.proxy)
but the setup is very easy and the sample.conf is
self explaining.

sshttp is in the git

A few days ago, I put the sshttp project to the github.

It allows to run SSH and HTTP(S) on the same port

without changing them.

I also checked in new code for lophttpd, to support

IPv6 and bind's to specific addresses other than

INADDR_ANY.

The benchmarks I did were really satisfying, it outperforms

default apache2 installs (surprise, surprise) and also

ngnix. Hope to get some time to plot some statistics

about that.

All your servers are belong to us

We deliver. Worldwide. Up to 0x743c times. And if you
are still not there, we return to libc.


You just noticed it, there is a new front pic online. I'll rotate
this within the next months to show cool and the gang
in different positions inside the cloud. The experienced
reader also noticed that the shirts are all made of valid
RPM switches and indeed the most important ones.


While I myself will definitely keep up with mobile stuff, our
origin are servers and the code running there. We deliver
stable, fast and secure services. If you have any problems
with your server or code, just call us.

me hubbing and gitting on github

As of today you can also find me on github.
I am testing how good or bad it performs for my own projects.
For now, I made lophttpd a public repo where you can
watch the development process.
My openwall site and other places where I used to put code
stay the same and I will continue to upload .tgz files.

Censorship

In this' blog survey "Do you like surveys?", too many people voted that I am an idiot, rather than they dislike surveys (less amount 
than people who like surveys though) so I do it like middle east
dictatorship: I just cancel it :P

openpam trickery

While reviewing an entirely different server side component
of some code, I came across a funny vulnerability inside
OpenPAM (note that this is different from Linux-PAM)
as used in FreeBSD or Solaris. Yet, I only tested it on
a FreeBSD 8.1 machine. The bug is that a program,
namely kcheckpass, which is suid to root, is calling
pam_start() with a user provided argument which makes
the PAM stack parse user owned
config files which ends in loading of user
provided DSO's. WTF?!


Interestingly, OpenPAM recently introduced a filter for
the service name via


http://trac.des.no/openpam/changeset/478/trunk/lib/openpam_configure.c

commit but I dont think that any BSD or so vendor is
aware of it.


A really trivial PoC exploit can be found here.


[Update:] Solaris is not using OpenPAM (at least the OpenSolaris
version I checked), but I could not find code that strips
off certain character sequences. As the PAM setup is different
from the /etc/pam.d we know it is possible that there are no
consequences if the service argument is not filtered.
However a lot of BSD derivates
use OpenPAM and OSX as well. The question is whether one can
find a vector different than the kcheckpass which is usually
found with all KDE3 and KDE4 installs.
If you can confirm vulnerability on any Solaris or non-FreeBSD
machine, please let me know. Also if you found out how OSX
can be exploited this way.

Fun with git-upload-pack

The android git was recently moved so I was eager to check
out the new sources. But I always got a 403! What was wrong?
Looking into some forums showed that lots of folks seems to
have the same problems so I post this in the hope that it
saves other developers some hours of debugging. At the end it seems
just to be an issue about the git version or git setup.
I cloned a repo with a clean, new machine and compared the
HTTP stream with what I got from a working box to find
out why some checkouts worked and some dont. Heres is the
old git pull:

and here is the new one with the diff marked green:

Somewhat surprising since according to the download page
git 1.6.4 should just be fine.
Now everything works smoothly. Not a very technical issue indeed,
but tracking down strange issues helps to stay keen. More than
just searching the web for a solution.

AIO

I just uploaded my version of the AIO functions for Linux 2.6.
They use kernels io_ syscalls rather than doing everything with pthreads (like last time I checked with glibc).
It is available here.