Re: CGI security on a shared web server

From: Kurt Seifried (bugtraq@seifried.org)
Date: 05/28/02 

From: "Kurt Seifried" <bugtraq@seifried.org>
To: "Steffen Dettmer" <steffen@dett.de>, <secprog@securityfocus.com>
Date: Mon, 27 May 2002 23:12:49 -0600

>* Kurt Seifried wrote on Thu, May 23, 2002 at 14:05 -0600:
>> One possible solution, assuming you need to write the data but not read
it
>> until later is to encrypt it, generate a public/private keypair using
>> pgp/gnupg, load the public key onto the server with your app, have it
write
>> the files after encrypting the data. Thus you can retrieve the data (ftp,
>> www, whatever) and then decrypt it at your leisure and use it.

>I don't think that this makes things secure. If the web server
>runs as nobody, the CGI script must be executable for nobody. The

No. "assuming you need to write the data but not read it". Followed by "Thus
you can retrieve the data (ftp, www, whatever) and then decrypt it at your
leisure and use it.".

Kurt Seifried, kurt@seifried.org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/
http://www.iDefense.com/

Relevant Pages

  • Re: CGI security on a shared web server
    ... > until later is to encrypt it, generate a public/private keypair using ... runs as nobody, the CGI script must be executable for nobody. ...
    (SecProg)
  • Re: CGI security on a shared web server
    ... until later is to encrypt it, generate a public/private keypair using ... pgp/gnupg, load the public key onto the server with your app, have it write ...
    (SecProg)
  • Re: Plod Forensics (IT)
    ... nobody else either). ... There are however many applications that purport ... You can buy wireless HDDs these days. ... can also encrypt practically the entire HDD, ...
    (uk.legal)