Debian Bug report logs - #613345
please document session.gc_maxlifetime being set to 0 in NEWS.Debian

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Pierre Habouzit <madcoder@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libapache2-mod-php5: gc_probability set to 0

Date: Mon, 14 Feb 2011 09:44:14 +0100

Package: libapache2-mod-php5
Version: 5.3.3-7
Severity: grave

The last php5 upload sets session.gc_probability to 0, which means that
sessions aren't GC'ed anymore which is a possible source for DOSes

Message #10 received at 613345@bugs.debian.org (full text, mbox, reply):

From: Ondřej Surý <ondrej@debian.org>

To: Pierre Habouzit <madcoder@debian.org>, 613345@bugs.debian.org

Subject: Re: [php-maint] Bug#613345: libapache2-mod-php5: gc_probability set to 0

Date: Mon, 14 Feb 2011 13:03:44 +0100

close 613345
thank you

From php5-common.README.Debian:

Session storage
---------------

    Session files are stored in /var/lib/php5.  For security purposes, this
    directory is unreadable by non-root users.  This means that php5 running
    from apache2, for example, will not be able to clean up stale session
    files.  Instead, we have a cron job run every 30 mins that cleans up
    stale session files; /etc/cron.d/php5.  You may need to modify how
    often this runs, if you've modified session.gc_maxlifetime in your
    php.ini; otherwise, it may be too lax or overly aggressive in cleaning
    out stale session files.

Andres Salomon <dilinger@debian.org>  Fri, 03 Sep 2004 03:12:54 -0400


On Mon, Feb 14, 2011 at 09:44, Pierre Habouzit <madcoder@debian.org> wrote:
> Package: libapache2-mod-php5
> Version: 5.3.3-7
> Severity: grave
>
> The last php5 upload sets session.gc_probability to 0, which means that
> sessions aren't GC'ed anymore which is a possible source for DOSes
>
>
>
> _______________________________________________
> pkg-php-maint mailing list
> pkg-php-maint@lists.alioth.debian.org
> http://lists.alioth.debian.org/mailman/listinfo/pkg-php-maint
>



-- 
Ondřej Surý <ondrej@sury.org>
http://blog.rfc1925.org/

Message #17 received at 613345@bugs.debian.org (full text, mbox, reply):

From: Pierre Habouzit <madcoder@debian.org>

To: Ondřej Surý <ondrej@debian.org>

Cc: 613345@bugs.debian.org, control@bugs.debian.org

Subject: Re: [php-maint] Bug#613345: libapache2-mod-php5: gc_probability set to 0

Date: Mon, 14 Feb 2011 14:57:41 +0100

reopen 613345
retitle 613345 please document session.gc_maxlifetime being set to 0 in NEWS.Debian
severity 613345 normal
thanks

On Mon, Feb 14, 2011 at 01:03:44PM +0100, Ondřej Surý wrote:
> close 613345
> thank you
> 
> From php5-common.README.Debian:
> 
> Session storage
> ---------------
> 
>     Session files are stored in /var/lib/php5.  For security purposes, this
>     directory is unreadable by non-root users.  This means that php5 running
>     from apache2, for example, will not be able to clean up stale session
>     files.  Instead, we have a cron job run every 30 mins that cleans up
>     stale session files; /etc/cron.d/php5.  You may need to modify how
>     often this runs, if you've modified session.gc_maxlifetime in your
>     php.ini; otherwise, it may be too lax or overly aggressive in cleaning
>     out stale session files.
> 
> Andres Salomon <dilinger@debian.org>  Fri, 03 Sep 2004 03:12:54 -0400

Why wasn't it put in NEWS.Debian ?  I watch this file and wouldn't have
raised the bug if I had seen that.

This is a disruptive change that should go there.
-- 
·O·  Pierre Habouzit
··O                                                madcoder@debian.org
OOO                                                http://www.madism.org

Message #28 received at 613345@bugs.debian.org (full text, mbox, reply):

From: Ondřej Surý <ondrej@debian.org>

To: Pierre Habouzit <madcoder@debian.org>

Cc: 613345@bugs.debian.org, control@bugs.debian.org

Subject: Re: [php-maint] Bug#613345: libapache2-mod-php5: gc_probability set to 0

Date: Mon, 14 Feb 2011 15:10:19 +0100

close 613345
thank you

I am sorry, but the cron job mechanism is there from php4 4:4.3.8-8
and it's well documented in php.ini (i.e. no change has happened from
2004). I don't really see a reason why we should put there in
NEWS.Debian now.

Ondrej

On Mon, Feb 14, 2011 at 14:57, Pierre Habouzit <madcoder@debian.org> wrote:
> reopen 613345
> retitle 613345 please document session.gc_maxlifetime being set to 0 in NEWS.Debian
> severity 613345 normal
> thanks
>
> On Mon, Feb 14, 2011 at 01:03:44PM +0100, Ondřej Surý wrote:
>> close 613345
>> thank you
>>
>> From php5-common.README.Debian:
>>
>> Session storage
>> ---------------
>>
>>     Session files are stored in /var/lib/php5.  For security purposes, this
>>     directory is unreadable by non-root users.  This means that php5 running
>>     from apache2, for example, will not be able to clean up stale session
>>     files.  Instead, we have a cron job run every 30 mins that cleans up
>>     stale session files; /etc/cron.d/php5.  You may need to modify how
>>     often this runs, if you've modified session.gc_maxlifetime in your
>>     php.ini; otherwise, it may be too lax or overly aggressive in cleaning
>>     out stale session files.
>>
>> Andres Salomon <dilinger@debian.org>  Fri, 03 Sep 2004 03:12:54 -0400
>
> Why wasn't it put in NEWS.Debian ?  I watch this file and wouldn't have
> raised the bug if I had seen that.
>
> This is a disruptive change that should go there.
> --
> ·O·  Pierre Habouzit
> ··O                                                madcoder@debian.org
> OOO                                                http://www.madism.org
>



-- 
Ondřej Surý <ondrej@sury.org>
http://blog.rfc1925.org/

Send a report that this bug log contains spam.