How to Use FILTCFG to Protect Against Possible Security Vulnerability with ApacheAdmin on NetWare 6.5

How to Use FILTCFG to Protect Against Possible Security Vulnerability with ApacheAdmin on NetWare 6.5

TID 7001907 gives details about a potential security vulnerability with Apache, or more specifically ApacheAdmin, on NetWare 6.5 after you've installed an OES2 Linux server into the same tree.



However there seems to (currently) be some ambiguity about the actual cause and suggested fix.



Here's one way of securing access to port 2200 on your NetWare server using FILTCFG.




  1. edit sys:/etc/builtins.cfg and add the following line (perhaps before IPX services are defined)

  2. PROTOCOL-SERVICE IP, NWWebMgr, pid=TCP port=2200 srcport=<All>, NetWare Web Manager

  3. load INETCFG and navigate to Protocols | TCP/IP

  4. change Filter Support to Enabled

  5. load FILTCFG and navigate to Configure TCP/IP Filters | Define TCP/IP filters | Packet Forwarding Filters

  6. change Status to Enabled

  7. press [Ins] twice on Filters to add the following filter

  8. Packet Type: NWWebMgr

  9. press [Esc] and select Yes when prompted to Save Filter?

  10. press [Ins] twice on Exceptions to add the following exception

  11. Packet Type: NWWebMgr
    Src Addr Type: Network
    Src IP Address: network/netmask

  12. press [Esc] and select Yes when prompted to Save Filter?

  13. press [Esc] four times and select Yes when prompted to Exit FILTCFG?

  14. RESTART SERVER (unfortunately - to re-read builtins.cfg)

Labels (1)

DISCLAIMER:

Some content on Community Tips & Information pages is not officially supported by Micro Focus. Please refer to our Terms of Use for more detail.
Comments
From same TID

Resolution
The fix to this issue is to apply support pack 8 to the server.
That is the published fix.

However I am aware of instances where the problem still exists AFTER SP8 has been applied to the NetWare server.
Yeah, what happened with SP8? I encountered another "published" fix that wasn't fixed just the other day: "260382 SCRSAVER - req for emergency password stored locally in an ecrypted file" was not included, even though it was published.
Top Contributors
Version history
Revision #:
1 of 1
Last update:
‎2009-01-30 01:22
Updated by:
 
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.