Re: CGI security on a shared web server

From: H D Moore (sflist@digitaloffense.net)
Date: 05/28/02 

From: H D Moore <sflist@digitaloffense.net>
To: Steffen Dettmer <steffen@dett.de>, secprog@securityfocus.com
Date: Mon, 27 May 2002 22:19:37 -0500

On Saturday 25 May 2002 10:34, Steffen Dettmer wrote:
> * Kurt Seifried wrote on Thu, May 23, 2002 at 14:05 -0600:
> > One possible solution, assuming you need to write the data but not read
> > it until later is to encrypt it, generate a public/private keypair using
> > pgp/gnupg, load the public key onto the server with your app, have it
> > write the files after encrypting the data. Thus you can retrieve the data
> > (ftp, www, whatever) and then decrypt it at your leisure and use it.
>
> I don't think that this makes things secure. If the web server
> runs as nobody, the CGI script must be executable for nobody. The
> secret key must be reable for nobody.

I think you missed the point here, what Kurt suggested was that you only place
the PUBLIC key on the web server and encrypt (not sign) the data you want to
store. When you want access to the data, you download the files and decrypt
them on your local server/workstation/etc. This doesn't prevent someone from
writing bogus data into your file, but it does keep them from reading it.

-HD

Relevant Pages

  • Can CryptoAPI encrypt with the private key? Required for software protection system.
    ... I know the entire purpose of public key cryptography is to encrypt ... (encrypttion with the private key and decryption with the public key). ... Web server hashes the data using MD5 then encrypts ...
    (sci.crypt)
  • Re: CGI security on a shared web server
    ... >> until later is to encrypt it, ... >> pgp/gnupg, load the public key onto the server with your app, have it write ... > runs as nobody, the CGI script must be executable for nobody. ... That's the whole point of "public key" ...
    (SecProg)
  • Re: nobody using sudo -- scary!
    ... don't run your webserver as "nobody". ... If this web server is tightly controlled and only used for controlling ... it permission to run that script. ...
    (comp.lang.perl.misc)
  • Re: encryption
    ... Thanks for the responses. ... My only concern is with passing unencrypted passwords from the web server to the d3 server. ... Our plan is to never allow passwords to never appear unencrypted at any point in the transaction and to validate passwords only by comparing encrypted values. ... I know how to encrypt a password in D3 but would like to encrypt the password on the web side and pass it already encrypted to D3. ...
    (comp.databases.pick)
  • RE: username and Password sent as clear text strings
    ... ipsec communication to only encrypt traffic to this particular ... What does everyone think of implementing a IPSEC solution to resolve the ... SSL was designed for client application-to-server application ... I completed a security review of a web server, ...
    (Pen-Test)