From Tue Aug 19 11:49:04 2008 Date: Tue, 19 Aug 2008 11:49:04 -0700 (PDT) From: Postmaster Subject: Message from mail server Content-Length: 95 Mime-Version: 1.0 Status: RO X-IMAP: 1219171744 2 Delete. This is a system message. --END+PSEUDO-- From sacadmin Tue Aug 5 15:07:44 2008 Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m75M7i1S019435; Tue, 5 Aug 2008 15:07:44 -0700 (PDT) Received: (from rm129958@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id m75M7isN019431; Tue, 5 Aug 2008 15:07:44 -0700 (PDT) Date: Tue, 5 Aug 2008 15:07:44 -0700 (PDT) From: Richard Jr Matthews Message-Id: <200808052207.m75M7isN019431@sac.sfbay.sun.com> To: LSARC@sac.sfbay.sun.com Subject: webalizer [LSARC/2008/503 FastTrack timeout 08/12/2008] Content-Length: 16656 Status: RO X-Status: $$$$ X-UID: 0000000001 I am sponsoring the following Fast Track for Daria Mehra. The project requests a minor release binding. -- Template Version: @(#)sac_nextcase 1.66 04/17/08 SMI This information is Copyright 2008 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: webalizer 1.2. Name of Document Author/Supplier: Author: Daria Mehra 1.3 Date of This Document: 05 August, 2008 4. Technical Description FCL--FOSS Check List 0. Introduction 0.1 Document History Version Author Changes 0.1 Daria Mehra Initial Draft 07/28/08 0.2 Purpose This checklist is to aid in the FastTrack ARC review proces for the integration of webalizer project into OpenSolaris. 1.0 Project Information 1.1 Name of project/component webalizer 1.2 Author of document Daria Mehra (daria.mehra@sun.com) 2.0 Project Summary 2.1 Project Description Webalizer is a popular open-source application for web server log file analysis with HTML output. It is implemented as a C program, runs from command line or by use of configuration files, supports many format of webserver logs (CLF, NCSA, FTP, squid, W3C), handles gzip and bzip2 compressed logs, partial logs, unlimited log file sizes, and many languages besides English. Webalizer performs traffic analysis based on the webserver logs. Statistics commonly reported by Webalizer include: hits; visits; referrers; the visitors' countries; and the amount of data downloaded. These statistics are presented graphically with hourly/daily/monthly breakdown. Webalizer has a lively open-source community with active forum and a recently released stable version 2.20-01 (July 2008). See http://www.webalizer.org/ site. Previous version 2.01-10 was from April 2002; note that wikipedia incorrectly claims development stopped in 2002. Wikipedia lists webalizer as one of the most commonly used web server administration tools: http://en.wikipedia.org/wiki/Webalizer It can be expected that system administrators who run web servers (such as Apache) on OpenSolaris will appreciate the inclusion of webalizer with the distribution. 2.2 Release binding What is is the release binding? (see http://opensolaris.org/os/community/arc/policies/release-taxonomy/) [ ] Major [X] Minor [ ] Patch or Micro [ ] Unknown -- ARC review required 2.3 Originating Community 2.3.1 Community Name http://www.webalizer.org/ 2.3.2 Community Involvement Indicate Sun's involvement in the community [ ] Maintainer [ ] Contributor [X] Monitoring Will the project team work with the upstream community to resolve architectural issues of interest to Sun? [X] Yes [ ] No - briefly explain Will we or are we forking from the community? [ ] Yes - ARC review required prior to forking [X] No 3.0 Technical Description 3.1 Installation & Sharable 3.1.1S Solaris Installation - section only required for Solaris Software (see http://opensolaris.org/os/community/arc/policies/install-locations/ for details) Does this project follow the Install Locations best practice? [X] Yes [ ] No - ARC review required Does this project install into /usr under [sbin|bin|lib|include|man|share]? [ ] Yes [X] No or N/A Does this project install into /opt? [ ] Yes - explain below [X] No or N/A Does this project install into a different directory structure? [ ] Yes - ARC review required [X] No or N/A Do any of the components of this project conflict with anything under /usr? (see http://opensolaris.org/os/community/arc/caselog/2007/047/ for details) [ ] Yes - explain below [X] No If conflicts exist then will this project install under /usr/gnu? [ ] Yes [ ] No - ARC review required [X] N/A Is this project installing into /usr/sfw? [ ] Yes - ARC review required [X] No 3.1.1W Windows Installation - section only required for Windows Software (see http://sac.sfbay/WSARC/2002/494 for details) Does this project install software into a :\Program Files\Sun\ or :\Sun\ directory? [ ] Yes [ ] No - ARC review required Does the project use the Windows registry? [ ] Yes [ ] No - ARC review required Does the project use HKEY_LOCAL_MACHINE\SOFTWARE\Sun Microsystems\\ for the registry key? [ ] Yes [ ] No - ARC review required Is the project's stored location HKEY_LOCAL_MACHINE\SOFTWARE\Sun Microsystems\\\Path? [ ] Yes [ ] No - ARC review required 3.1.2 Share and Sharable Does the module include any components that are used or shared by other projects? [ ] Yes [X] No If yes are these components packaged to be shared with the other FOSS? [ ] Yes [ ] No - ARC review required Are these components already in the Solaris WOS? [ ] Yes [ ] No - continue with next section If yes are these newer versions being delivered? [ ] Yes [ ] No - ARC review required If yes are the newer versions replacing the existing versions? [ ] Yes [ ] No - ARC review required 3.2 Libraries - N/A Are 64-bit libraries being delivered? [ ] Yes [ ] No - ARC review required Are static versions of the library being delivered? [ ] Yes - ARC review required [ ] No 3.3 Services and the /etc Directory (see http://opensolaris.org/os/community/arc/policies/SMF-policy/) Does the project integrate anything into /etc/init.d or /etc/rc?.d? [ ] Yes - ARC review required [X] No Does the project integrate any new entries into /etc/inittab or /etc/inetd.conf? [ ] Yes - ARC review required [X] No Does the project integrate any private non-public files into /etc/default or /etc/ configuration files? [ ] Yes - ARC review required [X] No Does the service manifests method context grant rights above that of the noaccess user and basic privilege set? [ ] Yes - ARC review required [X] No 3.4 Security 3.4.1 Secure By Default (see http://opensolaris.org/os/community/arc/policies/secure-by-default/ for details) (see http://www.opensolaris.org/os/community/arc/policies/NITS-policy/ for details) (see parts of http://opensolaris.org/os/community/arc/policies/SMF-policy/ for addtional details) Are network services enabled by default? [ ] Yes - ARC review required [ ] No [X] N/A Are network services automatically enabled by the project during installation? [ ] Yes - ARC review required [ ] No [X] N/A Are inbound network communications denied by default? [ ] Yes [ ] No - ARC review required [X] N/A Is inbound data checked to prevent content-based attacks? [ ] Yes [ ] No - ARC review required [X] N/A Is the outbound receiver authenticated? [ ] Yes [ ] No - ARC review required [X] N/A Is the receiver authenticated prior to receiving any sensitive outbound communication? [ ] Yes [ ] No - ARC review required [X] N/A 3.4.2 Authorization (see http://opensolaris.org/os/community/arc/bestpractices/rbac-intro/ and http://opensolaris.org/os/community/arc/bestpractices/rbac-profiles/ and http://opensolaris.org/os/community/arc/bestpractices/rbac-profiles/ for details) Are there any setuid/setgid privileged binaries in the project? [ ] Yes - ARC review required [X] No - continue with next section If yes then are the setuid/setgid privileges handled by the use of roles? [ ] Yes [ ] No - ARC review required 3.4.3 Auditing (see http://opensolaris.org/os/community/arc/policies/audit-policy/ for details) (see http://opensolaris.org/os/community/arc/caselog/2003/397 for details) Does this component contain administrative or security enforcing software? [ ] Yes - ARC review required [X] No - continue to next section (see http://opensolaris.org/os/community/arc/caselog/2003/397 for details) Do the components create audit logs detailing what took place including what event took place, who was involved, when the event took place? [ ] Yes - ARC contract and Audit project team review required [ ] No - ARC review required 3.4.4 Authentication (see http://opensolaris.org/os/community/arc/policies/PAM/) Do the components contain any authentication code? [ ] Yes [X] No - continue to next section If yes do the components use PAM (plugable authentication modules) for authentication? [ ] Yes [ ] No - ARC review required If yes is a single PAM session maintained during authentication? [ ] Yes [ ] No - ARC review required If yes are the components sufficiently privileged to allow the requested operations (authentication, password change, process credential manipulation, audit state initialization)? [ ] Yes - briefly describe below [ ] No - ARC review required 3.4.5 Passwords (see http://opensolaris.org/os/community/arc/bestpractices/passwords-cli/ and http://opensolaris.org/os/community/arc/bestpractices/passwords-files/ for details) Do any of the components for the project deal with passwords? [ ] Yes [X] No - continue to next section If yes are these passwords entered via the CLI or environment? [ ] Yes - ARC review required [ ] No Are passwords stored within the file system for the component? [ ] Yes [ ] No - continue to next section If yes are the permissions on the file such to protect exposing the password(s)? [ ] Yes [ ] No - ARC review required 3.4.6 General Security Questions (see http://opensolaris.org/os/community/arc/bestpractices/security-questions/ for details) Do the components use standard network protocols? [ ] Yes [ ] No - ARC review required [X] N/A Do network services for the project make decisions based upon user, host or service identities? [ ] Yes - explain below [ ] No [X] N/A Do the components make use of secret information during authentication and/or authorization? [ ] Yes - explain below [ ] No [X] N/A 3.5 Networking Do the components access the network? [ ] Yes [X] No - continue to next section If yes do the components support IPv6? [ ] Yes [ ] No - ARC review required 3.6 Core Solaris Components Do the components of this project compete with or duplicate core Solaris components? [ ] Yes - ARC review required [X] No Examples of Core Solaris Components include but are not limited to: Secure By Default Authorizations PAM -- Plugable Authentication Module Privilege PRM -- Process Rights Management -- Privilege Audit xVm -- Virtualization zones / Solaris Containers PRM -- Process Rights Management RBAC -- Role Based Access Control TX / Trusted Extensions ZFS SMF -- Service Management Facility FMA -- Fault Management Architecture SCF -- Smart Card Facility IPsec 4.0 Interfaces (see http://www.opensolaris.org/os/community/arc/policies/interface-taxonomy/ for details) 4.1 Exported Interfaces Interface Name Classification Comments --------------------------- ------------------- --------------------------- SUNWwebalizer Uncommitted Webalizer packaging 4.2 Imported Interfaces Interface Name Classification Comments --------------------------- -------------------- -------------------------- Brief Interface Classifications - See Appendix C for definitions Volatile - use check list for approval Uncommitted - ARC review might be required, seek committee member advice package names do not require further review Committed - ARC review required Project Private - no review required, just documentat in table Contracted (interface modifier) - further review required Appendix A - References 1. Solaris Installation Locations Policy http://opensolaris.org/os/community/arc/policies/install-locations/ 2. /usr/gnu Installation ARC case http://opensolaris.org/os/community/arc/caselog/2007/047/ 3. Secure By Default Policy http://opensolaris.org/os/community/arc/policies/secure-by-default/ 4. Network Install Time Securityuy Policy http://www.opensolaris.org/os/community/arc/policies/NITS-policy/ 5. Adding RBAC Authorizations Policy http://opensolaris.org/os/community/arc/bestpractices/rbac-auths/ 6. When to use setuid -vs- RBAC roles and profiles http://opensolaris.org/os/community/arc/bestpractices/rbac-intro/ and 7. Building RBAC Rights Profiles http://opensolaris.org/os/community/arc/bestpractices/rbac-profiles/ 8. Solaris Audit Policy http://opensolaris.org/os/community/arc/policies/audit-policy/ 9. Security questionaire http://opensolaris.org/os/community/arc/bestpractices/security-questions/ 10. Interface Taxonomy http://www.opensolaris.org/os/community/arc/policies/interface-taxonomy/ 11. Plugable Authentication Modules -- PAM http://opensolaris.org/os/community/arc/policies/PAM/ 12. Reusable Passwords In Command Line Arguments and Environment Variables http://opensolaris.org/os/community/arc/bestpractices/passwords-cli/ 13. Storing Reusable Passwords on a Filesystem http://opensolaris.org/os/community/arc/bestpractices/passwords-files/ 14. Release Taxonomy http://opensolaris.org/os/community/arc/policies/release-taxonomy/ 15. Service Management Facility (SMF) usage http://opensolaris.org/os/community/arc/policies/SMF-policy/ Appendix B - Suggested case materials 1. man pages 2. SMF manifests 3. links to contracts Appendix C - Definitions Submitter an agent responsible for creation of an ARC project along with the materials describing that project. Owner the ARC agent responsible for shepherding the case through review and ensuring a formal opinion is written where required. Maintainer an agent responsible for releasing new versions of a program, typically the "main" contributor or person incharge of making Architectural decisions for the project Contributor an agent who make contributions to a project, typically has a voice in making Architectural decisions for the project Monitoring an agent who is only following the changes made in the community and has no Architectural input into the project Volatile* interfaces that are very fluid and typically follow the originating community. Typically these interfaces can not be imported by other projects. Uncommitted* interfaces that are still evolving but will most likely be present from release to release. Committed* interfaces that are stable and with Sun guaranteeing some level of compatibility from release to release. Project Private* interfaces that are exposed only to or intended to be used only by the project being reviewed. These interfaces can not be imported by other projects. Not-An-Interface* components that are not interfaces. Contracted* (interface modifier) - ARC review of Contract required interfaces that do not allow another project to import can be *Note: see http://opensolaris.org/os/community/arc/policies/interface-taxonomy/ for details 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: SFW 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From Richard.Matthews@SUN.COM Tue Aug 12 10:18:25 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m7CHIPuB024884 for ; Tue, 12 Aug 2008 10:18:25 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m7CHIJtT011754 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Tue, 12 Aug 2008 11:18:25 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K5I00B0702OTD00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 12 Aug 2008 10:18:24 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K5I000M502NKSD0@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 12 Aug 2008 10:18:23 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m7CHINWx004620 for ; Tue, 12 Aug 2008 17:18:23 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K5H00901ZIN1700@mail-amer.sun.com> (original mail from Richard.Matthews@Sun.COM) for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 12 Aug 2008 11:18:23 -0600 (MDT) Received: from [129.152.9.14] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K5I007SC02IF770@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 12 Aug 2008 11:18:18 -0600 (MDT) Date: Tue, 12 Aug 2008 12:18:18 -0500 From: Rick Matthews Subject: LSARC/2008/503 - Webalizer Sender: Richard.Matthews@SUN.COM To: LSARC-ext@SUN.COM, Daria Mehra Reply-to: Richard.Matthews@SUN.COM Message-id: <48A1C5DA.6070501@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 User-Agent: Thunderbird 2.0.0.12 (X11/20080228) Content-Length: 507 Status: RO X-Status: $$$$ X-UID: 0000000002 Was approved at todays LSARC meeting. -- --------------------------------------------------------------------- Rick Matthews email: Rick.Matthews@sun.com Sun Microsystems, Inc. phone:+1(651) 554-1518 1270 Eagan Industrial Road phone(internal): 54418 Suite 160 fax: +1(651) 554-1540 Eagan, MN 55121-1231 USA main: +1(651) 554-1500 --------------------------------------------------------------------- From sacadmin Wed Nov 19 19:15:32 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAK3FWIV000768 for ; Wed, 19 Nov 2008 19:15:32 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAK3FQZC020733 for <@sunmail2sca.sfbay.sun.com:LSarc@sun.com>; Wed, 19 Nov 2008 20:15:31 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAM00H073PT6000@nwk-avmta-1.sfbay.Sun.COM> for LSarc@sun.com (ORCPT LSarc@sun.com); Wed, 19 Nov 2008 19:15:29 -0800 (PST) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAM00EG83PTNM10@nwk-avmta-1.sfbay.Sun.COM> for LSarc@sun.com (ORCPT LSarc@sun.com); Wed, 19 Nov 2008 19:15:29 -0800 (PST) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id mAK3FTXU028842 for ; Wed, 19 Nov 2008 19:15:29 -0800 (PST) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0KAM00F013LBBJ00@fe-sfbay-09.sun.com> (original mail from Daria.Mehra@Sun.COM) for LSarc@sun.com (ORCPT LSarc@sun.com); Wed, 19 Nov 2008 19:15:29 -0800 (PST) Received: from daria-mehras-macbook-air.local ([129.150.18.214]) by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KAM0046W3PTNUB0@fe-sfbay-09.sun.com> for LSarc@sun.com (ORCPT LSarc@sun.com); Wed, 19 Nov 2008 19:15:29 -0800 (PST) Date: Wed, 19 Nov 2008 19:15:11 -0800 From: Daria Mehra Subject: LSARC/2008/503 - Webalizer - checklist correction In-reply-to: <48AC322F.4070902@Sun.COM> Sender: Daria.Mehra@sun.com To: LSarc@sun.com, Richard.Matthews@sun.com Message-id: <4924D63F.3080807@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <48AC322F.4070902@Sun.COM> User-Agent: Thunderbird 2.0.0.12 (Macintosh/20080213) Status: RO Content-Length: 1576 Rick, please let me know if you'd like a revised checklist to post in the case materials, otherwise I will assume that this email in the archive will be sufficient. The SFW Cteam review found a typo in the webalizer FOSS checklist, question 3.1.1S should have "Yes" checked for installing into /usr (webalizer binary is installed into /usr/bin and the man pages go into /usr/share/man). Please note correction: Does this project install into /usr under [sbin|bin|lib|include|man|share]? [X] Yes [ ] No or N/A Also, I noticed that my update for the interface table sent on 8/20/08 never made it into the case materials. Here is a newer update that includes SUNWwebalizerr (root) package requested by the CTeam. For the record, the interface table should contain: 4.0 Interfaces (see http://www.opensolaris.org/os/community/arc/policies/interface-taxonomy/ for details) 4.1 Exported Interfaces Interface Name Classification Comments --------------------------- ------------------- --------------------------- SUNWwebalizer Uncommitted User package SUNWwebalizerr Uncommitted Root package /usr/bin/webalizer Volatile Version 2.20-01 4.2 Imported Interfaces Interface Name Classification Comments --------------------------- -------------------- -------------------------- libgd (SUNWgd2) Uncommitted PSARC 2007/166 zlib (SUNWzlib) Uncommitted PSARC 2006/537 libpng (SUNWpng) Uncommitted LSARC 2003/568 bzip (SUNWbzip) Committed Thanks, -- daria