Fix not working to disable http trace in iPlanet 6.0 SP5

Question

Hello.
I'm running iPlanet web server 6.0 SP5 on Solaris 8. A recent security compliance scan disclosed a number of vulnerabilities, among them the fact that I have HTTP TRACE enabled. I applied the fix to obj.conf described at http://sunsolve6.sun.com/search/document.do?assetkey=1-26-50603-1&searchclause=security
stopped and restarted the server, but the TRACE did not disable. The way I test this is
<code>
telnet server-name http-portnum
TRACE / HTTP/1.1
HOST:hostname
</code>
Rather than generating an error (501?) as it should it comes back with
<code>
HTTP/1.1 200 OK
Server: Netscape-Enterprise/6.0
Date: Fri, 13 Aug 2004 20:31:44 GMT
Content-length: 36
Content-type: message/http
</code>
In addition if , instead of TRACE / HTTP/1.1 I use the command
<code>
OPTIONS * HTTP/1.1
</code>
I get
<code>
HTTP/1.1 200 OK
Server: Netscape-Enterprise/6.0
Date: Fri, 13 Aug 2004 20:32:03 GMT
Content-length: 0
Allow: HEAD, GET, PUT, POST, DELETE, TRACE, OPTIONS, MOVE, INDEX, MKDIR, RMDIR
</code>
So clearly it's not disabled.
Here is a snippet of the obj.conf file showing the inserted "fix" :
<code>
# Sun Netscape Alliance - obj.conf
# You can edit this file, but comments and formatting changes
# might be lost when the admin server makes changes.
<Object name="default">
<Client method="TRACE">
AuthTrans fn="set-variable" remove-headers="transfer-encoding" set-headers="cont
ent-length: -1" error="501"
</Client>
NameTrans fn="NSServletNameTrans" name="servlet"
NameTrans fn="document-root" root="$docroot"
PathCheck fn="unix-uri-clean"
PathCheck fn="check-acl" acl="default"
PathCheck fn="find-pathinfo"
PathCheck fn="find-index" index-names="index.html,home.html"
ObjectType fn="type-by-extension"
ObjectType fn="force-type" type="text/plain"
Service type="magnus-internal/jsp" fn="NSServletService"
Service method="(GET|HEAD)" type="magnus-internal/imagemap" fn="imagemap"
Service method="(GET|HEAD)" type="magnus-internal/directory" fn="index-common"
Service fn="shtml_send" type="magnus-internal/parsed-html" method="(GET|HEAD)"
Service method="(GET|HEAD|POST)" type="*~magnus-internal/*" fn="send-file"
AddLog fn="flex-log" name="access"
</Object>
</code>
Can anyone suggest why this isn't working? I've beaten this one to death. Thanks. Peter.

Answer 1

1) Why would TRACE and OPTION request specifying HTTP 1.0 vs. 1.1 yield such different results?
Web Server 6.0 only implements the TRACE and OPTIONS methods for HTTP/1.1, not HTTP/1.0. This is reasonable as TRACE and OPTIONS are part of the HTTP/1.1 protocol and not the HTTP/1.0 protocol.
In other words, TRACE is always disabled for HTTP/1.0 requests, even if you don't use the set-variable work around.
2) Is the OPTIONS command a legitimate test of whether this fix works? If it is, has anyone managed to have the command return an "Allow:" line MINUS the TRACE?
Nope, not in Web Server 6.0. OPTIONS will always list TRACE. (Note that in Web Server 6.1, TRACE is not as tightly integrated into the server core. As a result, OPTIONS will conditionally list TRACE in 6.1.)
3) Has anyone managed to generate a 501 error message after specifying TRACE / HTTP/1.1 instead of 1.0?
Nope, not in Web Server 6.0.
4) Does this fix really work?
I wouldn't call it a fix; it's a work around. However, it does effectively disable TRACE. The work around is a bit of a kludge, resulting in the odd 413 status code.
The real "fix" appears in Web Server 6.1 where you can disable TRACE simply by commenting out the Service method="TRACE" fn="service-trace" line in obj.conf.