<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments for linsec.ca blog</title>
	<atom:link href="http://linsec.ca/blog/comments/feed/" rel="self" type="application/rss+xml" />
	<link>http://linsec.ca/blog</link>
	<description>You can have it right, or you can have it now.  But you can&#039;t have it right now.</description>
	<lastBuildDate>Tue, 22 May 2012 12:03:18 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.2</generator>
	<item>
		<title>Comment on Kerberos on OS X 10.7 (Lion) by Cerebus</title>
		<link>http://linsec.ca/blog/2011/07/26/kerberos-on-os-x-10-7-lion/comment-page-1/#comment-6730</link>
		<dc:creator>Cerebus</dc:creator>
		<pubDate>Tue, 22 May 2012 12:03:18 +0000</pubDate>
		<guid isPermaLink="false">http://linsec.ca/blog/?p=1010#comment-6730</guid>
		<description>If anyone&#039;s still reading this thread, Lion is performing a complete AS subprotocol at screen unlock.  This makes sense, as it&#039;s the only way to ensure the network account credentials are fresh for offline use (Windows has the same behavior at unlock).

The problem is on Lion this creates a *new* instance of the ccache.  If you&#039;re VPN&#039;d and have a valid ticket, lock the screen, drop the VPN (e.g., timeout), and then unlock the screen, you will have a *second* ccache with no valid tickets in it, *plus* the ccache with your (still unexpired) tickets.  If you VPN back in, some apps will see the current empty ccache and some will see the old ccache and attempt to use those tickets.

Very confusing.

-- C</description>
		<content:encoded><![CDATA[<p>If anyone&#8217;s still reading this thread, Lion is performing a complete AS subprotocol at screen unlock.  This makes sense, as it&#8217;s the only way to ensure the network account credentials are fresh for offline use (Windows has the same behavior at unlock).</p>
<p>The problem is on Lion this creates a *new* instance of the ccache.  If you&#8217;re VPN&#8217;d and have a valid ticket, lock the screen, drop the VPN (e.g., timeout), and then unlock the screen, you will have a *second* ccache with no valid tickets in it, *plus* the ccache with your (still unexpired) tickets.  If you VPN back in, some apps will see the current empty ccache and some will see the old ccache and attempt to use those tickets.</p>
<p>Very confusing.</p>
<p>&#8211; C</p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on Apache mod_rewrite frustration by vdanen</title>
		<link>http://linsec.ca/blog/2012/05/05/apache-mod_rewrite-frustration/comment-page-1/#comment-6684</link>
		<dc:creator>vdanen</dc:creator>
		<pubDate>Fri, 11 May 2012 21:05:09 +0000</pubDate>
		<guid isPermaLink="false">http://linsec.ca/blog/?p=1073#comment-6684</guid>
		<description>Ok, found the solution here:

http://serverfault.com/questions/55323/disable-mod-rewrite-for-subdirectory

After enabling some rewrite logging:

&lt;code&gt;
RewriteLog /tmp/rewrite.log
RewriteLogLevel 9
&lt;/code&gt;

I noticed that it was immediately trying to get a 401 error document, which meant that authorization was not working and was pretty much being bypassed altogether.

The solution was to, in my httpd.conf, add:

&lt;code&gt;
        ErrorDocument 401 &quot;Unauthorized Access&quot;
        RewriteEngine off
&lt;/code&gt;

Before the various Dav/Auth options.  Now everything works as expected.  I also got rid of the Alias directive and moved /home/user/dav to /home/user/public_html/dav; not sure if that is necessarily required, but it seems to have made a difference.</description>
		<content:encoded><![CDATA[<p>Ok, found the solution here:</p>
<p><a href="http://serverfault.com/questions/55323/disable-mod-rewrite-for-subdirectory" rel="nofollow">http://serverfault.com/questions/55323/disable-mod-rewrite-for-subdirectory</a></p>
<p>After enabling some rewrite logging:</p>
<p><code><br />
RewriteLog /tmp/rewrite.log<br />
RewriteLogLevel 9<br />
</code></p>
<p>I noticed that it was immediately trying to get a 401 error document, which meant that authorization was not working and was pretty much being bypassed altogether.</p>
<p>The solution was to, in my httpd.conf, add:</p>
<p><code><br />
        ErrorDocument 401 "Unauthorized Access"<br />
        RewriteEngine off<br />
</code></p>
<p>Before the various Dav/Auth options.  Now everything works as expected.  I also got rid of the Alias directive and moved /home/user/dav to /home/user/public_html/dav; not sure if that is necessarily required, but it seems to have made a difference.</p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on Apache mod_rewrite frustration by vdanen</title>
		<link>http://linsec.ca/blog/2012/05/05/apache-mod_rewrite-frustration/comment-page-1/#comment-6631</link>
		<dc:creator>vdanen</dc:creator>
		<pubDate>Sun, 06 May 2012 14:27:34 +0000</pubDate>
		<guid isPermaLink="false">http://linsec.ca/blog/?p=1073#comment-6631</guid>
		<description>Setting the RewriteBase to /dav works only for /, so anything like /page1 or /page2 is requesting auth (so maybe it&#039;s trying to rewrite /page1 to /dav/page1? the only thing requiring auth is /dav).

Using:

RewriteRule ^/dav - [L,PT]

doesn&#039;t work either.  /dav gets to Drupal&#039;s page not found page.  Also:

RewriteRule ^/dav/?(.*)$ /dav/$1 [L,QSA,PT]

doesn&#039;t work.  Normally I would say forget it and setup a subdomain (say dav.host.com) to get to it, but I have an SSL very host.com and want to get to the WebDAV via SSL (and since it&#039;s on the same IP address, I&#039;d get host-mismatch errors on the cert, which would probably break one or two of the programs I&#039;m using).

Thank you all for trying though!  The closest I got was with the RewriteBase, but that&#039;s almost too agressive.</description>
		<content:encoded><![CDATA[<p>Setting the RewriteBase to /dav works only for /, so anything like /page1 or /page2 is requesting auth (so maybe it&#8217;s trying to rewrite /page1 to /dav/page1? the only thing requiring auth is /dav).</p>
<p>Using:</p>
<p>RewriteRule ^/dav &#8211; [L,PT]</p>
<p>doesn&#8217;t work either.  /dav gets to Drupal&#8217;s page not found page.  Also:</p>
<p>RewriteRule ^/dav/?(.*)$ /dav/$1 [L,QSA,PT]</p>
<p>doesn&#8217;t work.  Normally I would say forget it and setup a subdomain (say dav.host.com) to get to it, but I have an SSL very host.com and want to get to the WebDAV via SSL (and since it&#8217;s on the same IP address, I&#8217;d get host-mismatch errors on the cert, which would probably break one or two of the programs I&#8217;m using).</p>
<p>Thank you all for trying though!  The closest I got was with the RewriteBase, but that&#8217;s almost too agressive.</p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on Apache mod_rewrite frustration by Jonas</title>
		<link>http://linsec.ca/blog/2012/05/05/apache-mod_rewrite-frustration/comment-page-1/#comment-6629</link>
		<dc:creator>Jonas</dc:creator>
		<pubDate>Sun, 06 May 2012 09:27:19 +0000</pubDate>
		<guid isPermaLink="false">http://linsec.ca/blog/?p=1073#comment-6629</guid>
		<description>Hi,

The URL rewrite pattern doesn&#039;t look correct.

RewriteRule ^/dav/?(.*)$ /dav/$1 [L,QSA,PT]

The first change is just to cope with the missing slash case, that is probably just a minor issue if it is an issue at all..

But the solution is the PT option I think...

Good luck!</description>
		<content:encoded><![CDATA[<p>Hi,</p>
<p>The URL rewrite pattern doesn&#8217;t look correct.</p>
<p>RewriteRule ^/dav/?(.*)$ /dav/$1 [L,QSA,PT]</p>
<p>The first change is just to cope with the missing slash case, that is probably just a minor issue if it is an issue at all..</p>
<p>But the solution is the PT option I think&#8230;</p>
<p>Good luck!</p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on Apache mod_rewrite frustration by Alexander E. Patrakov</title>
		<link>http://linsec.ca/blog/2012/05/05/apache-mod_rewrite-frustration/comment-page-1/#comment-6628</link>
		<dc:creator>Alexander E. Patrakov</dc:creator>
		<pubDate>Sun, 06 May 2012 08:28:35 +0000</pubDate>
		<guid isPermaLink="false">http://linsec.ca/blog/?p=1073#comment-6628</guid>
		<description>Two things:

1) You may want to rewrite /dav to &quot;-&quot; which means &quot;don&#039;t change the URL&quot;

2) You probably need the PT flag in the rewrite rule, because /dav is an alias.</description>
		<content:encoded><![CDATA[<p>Two things:</p>
<p>1) You may want to rewrite /dav to &#8220;-&#8221; which means &#8220;don&#8217;t change the URL&#8221;</p>
<p>2) You probably need the PT flag in the rewrite rule, because /dav is an alias.</p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on Apache mod_rewrite frustration by dmaphy</title>
		<link>http://linsec.ca/blog/2012/05/05/apache-mod_rewrite-frustration/comment-page-1/#comment-6626</link>
		<dc:creator>dmaphy</dc:creator>
		<pubDate>Sun, 06 May 2012 07:34:30 +0000</pubDate>
		<guid isPermaLink="false">http://linsec.ca/blog/?p=1073#comment-6626</guid>
		<description>Something like this should do the job and just not rewrite anything:

RewriteRule ^/dav - [L]

If I remember it correctly, the rule needs to be placed before any other RewriteRule.</description>
		<content:encoded><![CDATA[<p>Something like this should do the job and just not rewrite anything:</p>
<p>RewriteRule ^/dav &#8211; [L]</p>
<p>If I remember it correctly, the rule needs to be placed before any other RewriteRule.</p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on Apache mod_rewrite frustration by Stefan</title>
		<link>http://linsec.ca/blog/2012/05/05/apache-mod_rewrite-frustration/comment-page-1/#comment-6625</link>
		<dc:creator>Stefan</dc:creator>
		<pubDate>Sun, 06 May 2012 02:52:04 +0000</pubDate>
		<guid isPermaLink="false">http://linsec.ca/blog/?p=1073#comment-6625</guid>
		<description>I&#039;m not sure what will work (you probably need to set the &lt;a href=&quot;https://httpd.apache.org/docs/current/mod/mod_rewrite.html#rewritebase&quot; rel=&quot;nofollow&quot;&gt;RewriteBase&lt;/a&gt;), but you should also &lt;a href=&quot;https://httpd.apache.org/docs/current/rewrite/flags.html#flag_l&quot; rel=&quot;nofollow&quot;&gt;avoid loops&lt;/a&gt;.


RewriteEngine on
RewriteBase /dav
RewriteCond %{REQUEST_URI} !=/index.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !=/favicon.ico
RewriteRule ^(.*)$ /index.php?q=$1 [L,QSA]


Oh, AFAIK it doesn&#039;t need to be in httpd.conf for it to work. :)</description>
		<content:encoded><![CDATA[<p>I&#8217;m not sure what will work (you probably need to set the <a href="https://httpd.apache.org/docs/current/mod/mod_rewrite.html#rewritebase" rel="nofollow">RewriteBase</a>), but you should also <a href="https://httpd.apache.org/docs/current/rewrite/flags.html#flag_l" rel="nofollow">avoid loops</a>.</p>
<p>RewriteEngine on<br />
RewriteBase /dav<br />
RewriteCond %{REQUEST_URI} !=/index.php<br />
RewriteCond %{REQUEST_FILENAME} !-f<br />
RewriteCond %{REQUEST_FILENAME} !-d<br />
RewriteCond %{REQUEST_URI} !=/favicon.ico<br />
RewriteRule ^(.*)$ /index.php?q=$1 [L,QSA]</p>
<p>Oh, AFAIK it doesn&#8217;t need to be in httpd.conf for it to work. <img src='http://linsec.ca/blog/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> </p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on Fedora 15 upgrade by Aas</title>
		<link>http://linsec.ca/blog/2011/07/09/fedora-15-upgrade/comment-page-1/#comment-6618</link>
		<dc:creator>Aas</dc:creator>
		<pubDate>Fri, 13 Apr 2012 22:58:44 +0000</pubDate>
		<guid isPermaLink="false">http://linsec.ca/blog/?p=1008#comment-6618</guid>
		<description>I had the sema problem with rebooting Fedora after upgading from F14 to F15.
Every system a have upgraded gave me message:
Failed to talk to shutdownd, proceeding with immediate shutdown: No such file or directory
Failed to talk to init daemon.Initscripts are now placed in /lib/systemd/system/ instead of /etc/rc.d/init.d.

I just waited few seconds and the system has restarted anyway. But one system was different. I just couldn&#039;t be brought down by usual tools like:
shutdown -r 0
reboot
telinit 6
init 6
Nothing worked because all is dependant on init.
I&#039;ve found some suggestion to kill init with &quot;kill 1&quot; but I was scared to do so, because the system is several hundreds of kilometers away. (that&#039;s why reset button is not an option for me here)

So what I did?
Shut down every service running you know (except sshd of course) and do:
sync &amp;&amp; reboot -f

I&#039;m extremely cautios when there is a chance not to boot my system back up i know.
I hope this post helps someone. Happy upgrading!</description>
		<content:encoded><![CDATA[<p>I had the sema problem with rebooting Fedora after upgading from F14 to F15.<br />
Every system a have upgraded gave me message:<br />
Failed to talk to shutdownd, proceeding with immediate shutdown: No such file or directory<br />
Failed to talk to init daemon.Initscripts are now placed in /lib/systemd/system/ instead of /etc/rc.d/init.d.</p>
<p>I just waited few seconds and the system has restarted anyway. But one system was different. I just couldn&#8217;t be brought down by usual tools like:<br />
shutdown -r 0<br />
reboot<br />
telinit 6<br />
init 6<br />
Nothing worked because all is dependant on init.<br />
I&#8217;ve found some suggestion to kill init with &#8220;kill 1&#8243; but I was scared to do so, because the system is several hundreds of kilometers away. (that&#8217;s why reset button is not an option for me here)</p>
<p>So what I did?<br />
Shut down every service running you know (except sshd of course) and do:<br />
sync &amp;&amp; reboot -f</p>
<p>I&#8217;m extremely cautios when there is a chance not to boot my system back up i know.<br />
I hope this post helps someone. Happy upgrading!</p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on Working from home by Adam Williamson</title>
		<link>http://linsec.ca/blog/2012/02/22/working-from-home-2/comment-page-1/#comment-6430</link>
		<dc:creator>Adam Williamson</dc:creator>
		<pubDate>Wed, 22 Feb 2012 23:30:14 +0000</pubDate>
		<guid isPermaLink="false">http://linsec.ca/blog/?p=1056#comment-6430</guid>
		<description>I exceed my colleagues&#039; expectations daily! *hic*</description>
		<content:encoded><![CDATA[<p>I exceed my colleagues&#8217; expectations daily! *hic*</p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on rpm -V and prelinked binaries by Stuart</title>
		<link>http://linsec.ca/blog/2012/01/23/rpm-v-and-prelinked-binaries/comment-page-1/#comment-6410</link>
		<dc:creator>Stuart</dc:creator>
		<pubDate>Thu, 26 Jan 2012 17:32:05 +0000</pubDate>
		<guid isPermaLink="false">http://linsec.ca/blog/?p=1051#comment-6410</guid>
		<description>rpm --verify is not a &quot;poor man&#039;s&quot; AIDE. AIDE is for security. rpm -V is for troubleshooting. AIDE protects its database, rpm does not.</description>
		<content:encoded><![CDATA[<p>rpm &#8211;verify is not a &#8220;poor man&#8217;s&#8221; AIDE. AIDE is for security. rpm -V is for troubleshooting. AIDE protects its database, rpm does not.</p>
]]></content:encoded>
	</item>
</channel>
</rss>

