RE: CGI security on a shared web server

From: Jeff Dafoe (jeffd@naphost.com)
Date: 05/29/02 

From: "Jeff Dafoe" <jeffd@naphost.com>
To: "Beatie, Breck (ISSMountain View)" <BBeatie@iss.net>
Date: Wed, 29 May 2002 11:59:44 -0400

> I don't understand what risks there are to the server and
> machine as a whole, such that the server owner should be
> reluctant to enable this feature. Could someone please tell
> me what are the risks and how are these risks controlled in
> typical "good" use of suEXEC?

        I work as an admin at a hosting provider and I cannot imagine allowing CGIs
to run in a mass hosting environment under apache without the use of suexec.
Running end users' CGIs as the same user as the web server is asking for
problems, IMHO. Suexec, when improperly configured, can create a security
risk (as outlined in its installation documentation), but it is relatively
simple to configure it properly.
        So, when improperly configured, suexec can pose a problem. When properly
configured, it mitigates a variety of issues posed by running CGIs as the
same user as the web server.

Jeff

Relevant Pages

  • Re: Security risks in setting public_html to 777?
    ... > I'm running a web server, and I want some CGI scripts to be able to ... You'll only need that if the web server is running as a user ... that - as an example, with Apache, suexec can be used to let the cgi apps ...
    (comp.os.linux.security)
  • suexec and Apache 2.0.52 ?
    ... I am using Apache 2 with suexec enabled at my web server. ... but I hope Fedora people also knows the solution. ...
    (Fedora)
  • Re: CGI security on a shared web server
    ... > to run in a mass hosting environment under apache without the use of suexec. ... > Running end users' CGIs as the same user as the web server is asking for ... lends to a added layer of abstracted web security if you will. ...
    (SecProg)
  • Re: Database Security Issues
    ... >> a problem that ISPs and their customers face. ... Using suEXEC or other ... If the web server can read a file then anybody who uses that web ... and open_basedir can help prevent this, as can CGI mechanisms such ...
    (comp.lang.php)
  • Re: CGI security on a shared web server (fwd)
    ... > I don't see why someone would suEXEC setuid perl scripts. ... I don't suEXEC setuid perl scripts. ... rest were just fine running as user "web" or whatever the web server UID was. ...
    (SecProg)