| Jeff Abrahamson on Thu, 14 Nov 2002 11:30:06 -0500 |
|
On Thu, Nov 14, 2002 at 08:22:29AM -0500, Kevin Brosius wrote: > epike@isinet.com wrote: > > > > ok i have another question about webhosting. > > > > the scenario is, > > > > - lots of users using the same > > machine serving virtual websites. > > > > - some users may want their own cgi-bin > > > > regardless of any security i think of by way > > of permissions, I can't think of a secure way > > to protect the users files from each other. The reason > > is if somebody writes a cgi-bin that should be > > readable and executed by apache, then that process > > will have the power to read other people web files! > > Um, aren't these web page files? Why would you want to make them read > protected from other accounts? Aren't they already publicly accessible > through the web server? Yes, but there are subtleties. Let's say that you and I have accounts on machine www.foo.com. In ~jeff/public_html, I put some files with .htaccess or some other technique to make them servable only to some people. Meanwhile you write a cgi that displays the results of a "find ~jeff/public_html -print" and then lets you choose a file to display from that list. Because apache has to be able to read all these files to display them to authorized users, your cgi program can read them, too, unless apache is configured to change it's uid when running cgi's. So then my access control is for naught. Consider also that my cgi programs probably have my database user id and password embedded in them or at least in a preference file that they can read. But, again, those files are readable by apache, so I'd like to trust that you can't modify my web site just by signing up with my ISP, writing a cgi to find my database password, and then exploring and modifying my data. Iirc, the solution is to have apache chuid before change its uid before executing a cgi program. But I haven't set this up myself, so I'm not really sure of the apache config details. -- Jeff Jeff Abrahamson <http://www.purple.com/jeff/> Attachment:
pgpz2E8GU7epW.pgp
|
|