Re: CGI security on a shared web server (fwd)

From: Glynn Clements (glynn.clements@virgin.net)
Date: 05/24/02 

From: Glynn Clements <glynn.clements@virgin.net>
Date: Fri, 24 May 2002 18:38:42 +0100
To: secprog@securityfocus.com

Lee E. Brotzman wrote:

> In general, you don't have to have suEXEC to run setuid programs. If
> you can set the permission bits on CGI scripts on your shared web
> server, you can turn on the setuid bit for those few CGI scripts you
> need to have setuid.

I don't know about other Unices, but Linux deliberately doesn't
support setuid scripts (a wise move, IMHO). Perl attempts to
re-introduce the problem via the setuid "suidperl" binary, but many
sysadmins will disable that (again, a wise move, IMHO).

Finally, many virtual hosting providers solve both the problems
associated with running all CGI scripts as "nobody" and the potential
risks of suEXEC by simply not permitting users to upload CGI scripts
at all. If you want to run your own CGI scripts, you have to rent a
separate server. 

-- 
Glynn Clements <glynn.clements@virgin.net>

Relevant Pages

  • Re: CGI security on a shared web server (fwd)
    ... you don't have to have suEXEC to run setuid programs. ... set the permission bits on CGI scripts on your shared web server, ... on the setuid bit for those few CGI scripts you need to have setuid. ... I don't use suEXEC, mainly because it makes *all* the CGI scripts setuid. ...
    (SecProg)
  • Re: Another flaw in Apache?
    ... > Don't forget this is not a serious vulnerability in many configurations ... > (if the user already has permission to run cgi scripts without suexec, ... oh well, the child process itself. ... Besides, suexec is pretty ...
    (Vuln-Dev)
  • Re: CGI security on a shared web server (fwd)
    ... The living environment of any program invoked by suexec is cleaned up ... > setuid scripts of unknown quality on his system. ... only the account of the idiot who owns the insecure CGI ... better to let a user shoot into his/her own head than to let a user ...
    (SecProg)
  • Re: Another flaw in Apache?
    ... user already has permission to run cgi scripts without suexec, SSI, etc). ...
    (Vuln-Dev)
  • Secure CGI Path Access (translate file path "/" to user homedir)
    ... i just configured my webserver with suexec, ... Scripts are executed with the users uid. ... How do i prevent the CGI Scripts from ... all file permissions. ...
    (comp.os.linux.security)