Re: CGI security on a shared web server (fwd)

From: George Dinwiddie (gdinwiddie@min.net)
Date: 05/28/02 

From: George Dinwiddie <gdinwiddie@min.net>
To: leb@gmss.com (Lee E. Brotzman)
Date: Tue, 28 May 2002 17:14:57 -0400 (EDT)

> Lee E. Brotzman said:
>
> If suexec had an option for specifying which CGI programs to run setuid, then
> I agree that it is a decent wrapper program. Until then, I ain't agonna use it.

Well, it CAN be specified on a VirtualHost basis. It wouldn't have
to apply to all CGI programs on the server.

Also, this is a pretty small-beans web site, else it wouldn't be
running on a shared server. If I had a dedicated server, I wouldn't
need the capability.

I'm still not sure what risk the server owner runs other than the
fact that a misbehaving CGI would run in my account rather than as
nobody. I suppose this offers more privileges, but, as a user on
a shared server, I don't have a lot of privileges, anyway.

The suggestion to use a userid set up expressly for the purpose
(sharing my usergroup, I imagine) does have some appeal. The
datafiles could then have group read/write privileges, but the
setuid user could be restricted with no shell.

 - George 

-- 
 ----------------------------------------------------------------------
  George Dinwiddie                             gdinwiddie@alberg30.org
  The gods do not deduct from man's allotted span those hours spent in
  sailing.                                    http://www.Alberg30.org/
 ----------------------------------------------------------------------

Relevant Pages

  • Re: Remote Data Access Connection Testing
    ... Leave Internetuser and Password as an Empty string (e.g.... ... Used my internal IP address of my desktop machine / IIS Server / SQL Server ... I typically would like to use a WiFi connection to access ... >> 3)Are you specifying the server by machine name or IP address, ...
    (microsoft.public.dotnet.framework.compactframework)
  • Re: iPhone 3g
    ... I was specifying "remote.domainname.com/exchange" for the server. ... The correct way to specify the server as "remote.domainname.com" with nothing after it. ... MS-MVP - Windows Desktop Experience: ... I have read that some permissions may need to be changed in IIS. ...
    (microsoft.public.windows.server.sbs)
  • CGI security on a shared web server
    ... CGI programs ... as does the server itself. ... It also means that if my CGI program ... The response I've gotten is that this is a security ...
    (SecProg)
  • Re: Having Tcl script accessing files as a specific user
    ... server that have restricted access. ... Run the script via a special version of tclsh that has the setuid ... it fires off the process that it changes its file owner, ...
    (comp.lang.tcl)
  • Re: Help with passthru()
    ... I want to implement a Web based System administration page in PHP. ... Luckily, in my case, it was a server on our intranet, and I wasn't ... Don't use setuid on web scripts! ... Use cgiwrap to run the scripts as the logged in user rather than the web server's ID. ...
    (comp.lang.php)