Re: restricting permissions for services in Win2K

From: Robert Collins (robert.collins@itdomain.com.au)
Date: 02/20/02 

From: "Robert Collins" <robert.collins@itdomain.com.au>
To: <kevin@kbrownfox.net>, "KJK::Hyperion" <noog@libero.it>
Date: Thu, 21 Feb 2002 07:27:58 +1100

===
----- Original Message -----
From: "KJK::Hyperion" <noog@libero.it>
> This is the way I did it, and Apache has worked for months on this
machine
>
> [1] just for fun: SeTcbPrivilege is needed to log on a user, that is
> connecting to the LSASS, sending an username and password
(unfortunately,
> no privilege grants password-less access: this is an important
difference
> with Unix, and a serious limitation. It's the reason why Apache on
Unix
> doesn't need the password for the httpd account to spawn unprivileged
> children, while IIS on Windows does, even if both run as super-user),
and
> receiving a token that can be impersonated;
SeAssignprimarytokenPrivilege
> is needed to create a new process with a different primary token than
self
> (usually, to create a process as a different user). Related Win32
calls:
> LogonUser() and CreateProcessAsUser()

Also see SubAuthentication filters. Cygwin has a passwordless fork()
capability with the subauth dll - although it still requires
SeTcbPrivilege.

Rob

Relevant Pages

  • Re: help with QSYRUSRI
    ... marty schrieb: ... username and password when logging into sensitive areas of the web ... Write a plug-in for the Apache server to do what you want. ... The AS/400 is set up so that users have to change password every ...
    (comp.sys.ibm.as400.misc)
  • help with QSYRUSRI
    ... client browsers. ... Apache directives are set up to require AS/400 ... username and password when logging into sensitive areas of the web ... The AS/400 is set up so that users have to change password every ...
    (comp.sys.ibm.as400.misc)
  • Re: [PHP] $_ENV not working for me with PHP 4.2.0
    ... > I've been trying to make a simple script which just ... > outputs the username that the script is currently ... > executing under (in order to test that suexec is ... the USER that started apache. ...
    (php.general)
  • Re: Back from hols, and OT question (Apache server)
    ... friend to set me up an FTP username of apache? ... If your friend is a good linux guy he will sort this for you in two mins. Basically Apache would be running with minimal permissions on the server which is normal for security reasons and it can't read or write to files in different groups. ...
    (rec.autos.sport.f1)