iThemes Security not compatible with Apache 2.4

Totally true. Thanks for letting us know.

But the proposed solution will only work with the mod_version module loaded in Apache 2.4 …
Also iThemes will need to change the iTSec code to make this work …

Alternatively make sure the mod_access_compat module is loaded when using the iTSec plugin with Apache 2.4 which ensures backwards compatibility.

dwinden

I can confirm that mod_version is enabled by default on Apache 2.4.

What are my options if mod_access_compat is not available?

I can downgrade to Apache 2.2, but I need Apache 2.4 for other features.

Not in my (Windows) Apache 2.4 env, so I thought I better mention it …
There are so many different Apache distro’s out there that it’s better to be aware of this.

I’m sorry to say that if mod_access_compat is not available I think you are out of options …

iThemes needs to make the necessary changes to the iTSec plugin to support both Apache 2.2 and 2.4 (or higher) directives.
The information you provided comes in handy.

If you wish you can report a bug for this with iThemes directly:

https://ithemes.com/security/bugs/

dwinden

Hi,

This is very interesting. I’ve filed a report. I’ll make sure and update you here when I know more.

Thanks,

Gerroald

https://httpd.apache.org/docs/2.4/mod/mod_access_compat.html

Note
The directives provided by mod_access_compat have been deprecated by the new authz refactoring. Please see mod_authz_host.

https://en.wikipedia.org/wiki/Deprecation#Software_deprecation

While a deprecated software feature remains in the software, its use may raise warning messages recommending alternative practices; deprecated status may also indicate the feature will be removed in the future. Features are deprecated rather than immediately removed, to provide backward compatibility and give programmers time to bring affected code into compliance with the new standard.

My interpretation of the deprecation statement is this: mod_authz_host is the newer prefered method|module for Apache 2.3 and higher versions over mod_access_compat. The directives used in the mod_access_compat module have been listed as deprecated and may be removed entirely in the future (could be months from now or several years from now). At some point the mod_access_compat method|module may be phased out entirely (could be months from now or several years from now).

As long as the mod_access_compat module is loaded, whether or not the Apache version is 2.3 or higher versions, the Order, Allow and Deny directives work now and should work in the future (could be months from now or several years from now). I imagine web hosts will load the mod_access_compat module by default for many years to come and probably load the mod_authz_host module in addition to the mod_access_compat module.

This is the message I received from my web hosting provider when I asked whether they would install mod_access_compat:

Hello,

On Thu, 19 Feb 2015, 13:22:39 UTC, George Ellenburg wrote:
> Any chance of you revisiting and reconsidering your stance on
> mod_access_compat for Apache 2.4?

No, the information in the forum post you linked to is entirely correct, even moreso now than it was then. At this point, any plugin that has not been updated is well behind the curve. The detail omitted from that forum post is that ever module we load increases the resource usage of every Apache process we run, which means higher costs, which means higher prices. We simply cannot justify raising prices to provide a module the sole purpose of which is to prevent people (site operators or plugin authors) from having to make a couple of fairly trivial one-time changes.

…

…You may wish to contact the plugin authors for the other plugins, especially if they are security related, to find out if they are still being maintained. It’s hard to imagine that a currently-maintained plugin hasn’t made this update three years after Apache 2.4 became the recommended version.…

I tend to agree, but the problem is not specific to iThemes Security. Other popular WordPress plugins suffer the same problem by assuming everyone is still using Apache 2.2.

Then again, an argument could be made that Apache should never have changed mod_access but such is life.

The mod_access_compat module is a whopping 13 kb (Windows) …
So the cost argument is b******t …

Still they have a point … I think.
iThemes has had plenty of time to edit the iTSec plugin code.

So let’s see what needs to be changed in the iTSec plugin code just to support Apache 2.3 or higher mod_authz_host module new directives.

An automated search for the strings:

Order deny,allow
order deny,allow
Deny from all
deny from all
Allow from all
allow from all

through all iTSec plugin files should give us a rough idea of the number of files that need to be changed.
And here are the results from the Dutch jury (sorted in number of search hits):

core\class-itsec-files.php (3)
modules\free\ban-users\class-itsec-ban-users-admin.php (2)
modules\free\tweaks\class-itsec-tweaks-admin.php (2)
core\class-itsec-setup.php (1)

Let’s say I missed 2 files with the above search method.
The entire iTSec 4.6.8 plugin consists of 236 files so that means max ((4+2)/236)*100=2.54% of all files needs to be changed.

dwinden

At this point, any plugin that has not been updated is well behind the curve.

Pathetic. Obviously the person who made that statement does not understand basic standard software development procedures.

Shocking:

https://w3techs.com/technologies/details/ws-apache/2.2/all
https://w3techs.com/technologies/details/ws-apache/2.3/all
https://w3techs.com/technologies/details/ws-apache/2.4/all

Apache is used by 58.4% of all the websites.
Version 2.2 is used by 48% of all the websites !!!
Version 2.3 is used by 0,1% of all the websites.
Version 2.4 is used by 7.5% of all the websites !!!

dwinden

@gellenburg
For what it is worth, the iTSec plugin supports both Apache 2.2 and 2.4 directives as of release 4.8.0.

So I guess this topic can be marked as ‘resolved’.

dwinden

If you feel your question was answered please don’t hesitate to mark this topic as ‘resolved’.

dwinden