WebJob / News: Recent posts

Version 1.9.0 is a minor release of WebJob. Basically, the various changes, enhancements, additions, and bug fixes that have accumulated over the past few years reached critical mass.

Last month's issue of the ISSA Journal (January 2009, Volume 7, Issue 1) has a nice article about WebJob written by Russ McRee. The article, entitled "WebJob", explores some of the capabilities of WebJob. The article is available here:

http://holisticinfosec.org/toolsmith/docs/january2009.pdf

ISSA members can also get it here:

http://www.issa.org/Library/Journals/2009/January/McRee-toolsmith-WebJob.pdf

Version 1.8.0 is a minor release of WebJob. Generally, code was cleaned up and refined as necessary. Several bugs have been fixed -- see the ChangeLog for details. Externally, there have been several changes: embedded Perl support has been added; the client now includes failover/fallback support; the CGI script now includes queuing support via Job Queue Directories (JQD); and several new utilities and Perl modules have been added to improve server-side configuration and management. Note that nph-webjob.cgi now depends on several Perl modules, and it is no longer a drop in replacement.

Version 1.7.0 is a minor release of WebJob. Generally, code was cleaned up and refined as necessary. Several bugs have been fixed -- see the ChangeLog for details. Externally, there have been several changes: basic proxy support has been added; the client now includes a mode for downloading a specified URL; the CGI script now includes support for GET hooks, which can be used to create dynamic job content; and several useful utilities have been added to the tools directory.

Version 1.6.0 is a minor release of WebJob. Generally, code was cleaned up and refined as necessary. Several bugs have been fixed -- see the ChangeLog for details. Externally, there have been several changes: (1) Digital Signature Verification (DSV) support has been integrated into WebJob client/server components; (2) support for SHA256 hashes has been added; and (3) the CGI script now provides support for GET/PUT triggers and stricter SSL-based authentication checks.

Version 1.5.0 is a minor release of WebJob. Generally, code was cleaned up and refined as necessary. Several bugs have been fixed -- see the ChangeLog for details. Externally, there have been several changes: (1) the default installation directory has changed; (2) several new controls have been added; (3) WebJob and PaD tools now recognize or set certain environment variables; and (4) the CGI script provides support for per client/com mand configuration overrides. A test harness has been added along with tests to validate MD5/SHA1 hashes (including SHA-1 Sample Vectors provided and used by NIST). Internally, the main improvements are MD5/SHA1 performance and the addition of large file support.

This month's issue of Sys Admin Magazine (November 2004, Volume 13, Number 11) has a nice article about WebJob written by Dave Mangot. The article, entitled "WebJob -- Virtual Evidence Locker and Administration Tool", explores the various features, design goals, and uses of WebJob.

Version 1.4.0 is a minor release of WebJob. Generally, code was cleaned up and refined as necessary. Several bugs have been fixed -- see the ChangeLog for details. The configure/build process has been updated to include full support for AIX, HP-UX, amd64, and x86_64 platforms and partial support for MinGW -- OpenSSL enabled builds are not currently supported under MinGW. Externally, there have been several changes: (1) the ClientId control has been added -- going forward this will be a required control; (2) the client-side filename format has been changed; (3) two new capabilities, GetHook and Jids (Job IDs), have been added; (4) PaD's PAYLOAD token has been changed to %payload for consistency; and (5) the log file format for nph-webjob.cgi has been overhauled. Internally, WebJob's top-level logic has been redesigned so that uploads are always attempted when URLPutURL is defined. Previously, any error in the GET or RUN stages was considered fatal. Also, the nph-webjob.cgi script has been completely overhauled. The new script includes support for reading properties from a configuration file, and it has been ported to run under Apache on Win32 platforms. Note that some of the external changes, especially 1, 4, and 5, are not backwards compatible, and they will most likely require a migration plan.

Version 1.3.0 is a minor release of WebJob. Generally, code was cleaned up and refined as necessary. The configure/build process has been updated, and several new configure options were added. The client-side filename format was changed from webjob.stdxxx.hhhhhhhh to webjob_hhhhhhhh.xxx. Also, the logic used to seed the random number generator was modified to address an issue on NT/2K platforms. The major event for this release, however, was the addition of MD5 and SHA1 hashing support. Now, WebJob has the ability to compute a message digest of a specified file or stdin. This is useful in situations where the downloaded executable needs to compute a hash, but the target platform lacks the necessary hashing tools. Also, message digests of the std{out,err} streams are now computed and written to the stdenv stream. This will make it easier to check stream integrity on the server.

Version 1.2.3 is a update release of WebJob. Generally, code was cleaned up and refined as necessary. Faulty Content-Length detection and validation logic has been fixed. The PaD sub-project has been restructured and overhauled. New tools were added to facilitate PaD construction. The install location for nph-webjob.cgi has been moved to ${prefix}/cgi/cgi-client. Now, the CGI script allows the location of uploaded files to be customized, and it can be configured to search for requested programs/scripts in one or more shared directories. Finally, the configure/build process has been updated.

Version 1.2.2 is a update release of WebJob. Various files were cleaned up and/or synchronized with their FTimes counterparts. This includes the capability to embed SSL passphrases inside LRS pools. Payload and Delivery (PaD) technology has been added to the project. A PaD file is a self-extracting executable that allows the user to control if, when, and how its payload will be delivered.

WebJob downloads a program over HTTP/HTTPS and executes it in one unified operation. Output may be directed to stdout/stderr or a web resource. The intended audience includes Incident Response (IR) Handlers and System Administrators.

Version 1.2.1 is an update release of WebJob. The wait() logic was rewritten to fix a problem with Bourne shell scripts that use the <<EOF construct to deliver config file data to WebJob. Under the old logic, the target program/script could get deleted prior to or during its execution. Even though this problem could only be reproduced on FreeBSD systems, it has been addressed for all UNIX platforms.

Version 1.2.0 is a minor release of WebJob. Under the hood, the project went through some significant restructuring -- primarily to make room for three new platforms: NT/2K, Cygwin, and MacOS X. The default installation directory has changed for UNIX platforms. The new location is /usr/local/integrity. See the ChangeLog for more details.

Version 1.1.1 is an update release of WebJob. Changes worth noting include: webjob.1 now installs in ${prefix}/man/man1; nph-webjob.cgi and other files have been synchronized with their counterparts from The FTimes Project; added VPATH support; added code to record the following epochs: job, get, run, and put. See the ChangeLog for more details. This code has successfully compiled on FreeBSD, Linux, and Solaris.

Version 1.1.0 is a minor release of WebJob. The config file control/value separator has been changed from ':' to '=', and a new runtime control, OverwriteExecutable, has been added. See the ChangeLog for more details. This code has successfully compiled on FreeBSD, Linux, and Solaris.

WebJob downloads a program over HTTP/HTTPS and executes it in one unified operation. Output may be directed to stdout/stderr or a Web resource. The intended audience includes Incident Response (IR) Handlers and System Administrators.

Version 1.0.0 is the first official release of WebJob. Until further notice, it should be considered a beta release. This code has successfully compiled on FreeBSD, Linux, and Solaris.