You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Michael Carmack <ka...@karmak.org> on 2002/05/10 05:00:34 UTC
suexec questions
Two quick suexec questions:
1. What security risks are involved in setting "suexec-docroot=/"?
(Purpose: To allow virtual hosts to run cgi programs anywhere on
the filesystem.)
2. The suexec docs seem to state (#18) that the user must be the owner
of the cgi file being run. Am I misinterpreting this, or has this
been changed? (I've found that vhosts are able to run cgi programs
owned by anyone.)
Thanks,
m.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: suexec questions
Posted by Michael Carmack <ka...@karmak.org>.
On Fri, May 10, 2002 at 03:00:34AM +0000, Michael Carmack wrote:
>
>
> 2. The suexec docs seem to state (#18) that the user must be the owner
> of the cgi file being run. Am I misinterpreting this, or has this
> been changed? (I've found that vhosts are able to run cgi programs
> owned by anyone.)
Never mind this one. I just checked on this, and my statement here is
false.
m.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: suexec questions
Posted by Joshua Slive <jo...@slive.ca>.
On Fri, 10 May 2002, Michael Carmack wrote:
> > Consider the case where someone manages to compromise the apache userid.
> > Then this person would be able to run almost any program on the system
> > with the permission of that program's owner (subject to one or two other
> > suexec constraints -- they probably couldn't run as root). Nasty!
>
> If Apache has under a unique uid/gid and non-password account, is this
> still a threat? It seems the only way to get to the apache userid in such
> a case would be to go through root, but at that point security has already
> been fully comprimised anyway.
Although setting the apache userid shell to /bin/false and making other
restrictions on this account is a good idea, it cannot guarentee that the
account won't be exploited. The apache account can be exploited if
someone writes a non-suexeced cgi script that has a security problem or if
there is a bug in apache or one of its modules.
Joshua.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: suexec questions
Posted by Michael Carmack <ka...@karmak.org>.
On Fri, May 10, 2002 at 12:04:25AM -0400, Joshua Slive wrote:
> Michael Carmack wrote:
> >Two quick suexec questions:
> >
> >1. What security risks are involved in setting "suexec-docroot=/"?
> > (Purpose: To allow virtual hosts to run cgi programs anywhere on
> > the filesystem.)
>
>
> The security risk is that you allow programs to run anywhere on the
> filesystem.
>
> Consider the case where someone manages to compromise the apache userid.
> Then this person would be able to run almost any program on the system
> with the permission of that program's owner (subject to one or two other
> suexec constraints -- they probably couldn't run as root). Nasty!
If Apache has under a unique uid/gid and non-password account, is this
still a threat? It seems the only way to get to the apache userid in such
a case would be to go through root, but at that point security has already
been fully comprimised anyway.
m.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: suexec questions
Posted by Joshua Slive <jo...@slive.ca>.
Michael Carmack wrote:
> Two quick suexec questions:
>
> 1. What security risks are involved in setting "suexec-docroot=/"?
> (Purpose: To allow virtual hosts to run cgi programs anywhere on
> the filesystem.)
The security risk is that you allow programs to run anywhere on the
filesystem.
Consider the case where someone manages to compromise the apache userid.
Then this person would be able to run almost any program on the system
with the permission of that program's owner (subject to one or two other
suexec constraints -- they probably couldn't run as root). Nasty!
Joshua.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org