search

owasp-modsecurity / ModSecurity

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.
https://www.modsecurity.org
Apache License 2.0
8.03k stars 1.58k forks source link

IIS MSI installers not following MS standard for digital signature #1999

Open victorhora opened 5 years ago

victorhora commented 5 years ago

Describe the bug

Our friends from Apache Lounge (@SteffenAL) have reported that the ModSecurity IIS build/msi installer seems to be missing proper digital signatures leading to error / warning messages on modern versions of Windows.

This demands further investigation to see where it happens, workarounds and additional steps recommended for a future release.

To Reproduce

Steps to reproduce the behaviour:

When I download I get a big warning from IE, see attached pic.

image

The other problem with not signed .msi's is: when I double click on the .msi, I get in the Event viewer: ActivateApplicationForContractByExtensionIdAsUserWithHost of the app Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy!App for the Windows.Protocol contract failed with This app can't be activated by the Built-in Administrator.

Expected behavior

The MSI installer should ideally be digitally signed as per best practices to avoid warnings / errors such as the ones reported here.

Server (please complete the following information):

Additional context

Do not know if this also happens with Win10 or other server editions.

The MSIs are already digitally signed with PGP signatures as available here and here.

icing commented 5 years ago

FYI: I have nothing to do with ApacheLounge or Windows builds. You are probably talking about @SteffenAL here?

victorhora commented 5 years ago

Correct @icing. My bad. It's now fixed. Thanks! :)

victorhora commented 5 years ago

References:

https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/signtool https://docs.microsoft.com/en-us/windows/desktop/appxpkg/how-to-sign-a-package-using-signtool

tomcon21 commented 3 years ago

Hi @victorhora,

I am get prompted to select an application to run the ModSecurityIIS_2.9.3-64b.msi.asc on Windows. Is there additional software required to complete the installation or must I rename the file to drop the .asc file extension..

I am not sure of what the work around is..... Thanks...