You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by sunil sharma <ap...@yahoo.com> on 2002/10/16 08:44:40 UTC
[users@httpd] Virtual Hosting security issues
Hello Friend
I am very worried about my virtual host security
issues
On my server their are near about 550 virtual host's
are configured
folloing is the the of example of virtual hosts setup
on my server
VirtualHost no 1 "test.com"
#################################################################
<VirtualHost 192.168.1.10>
ServerAdmin webmaster@test.com
DocumentRoot /home/test.com/htdocs
ServerName test.com
ServerAlias www.test.com
ScriptAlias /cgi-bin/ /home/test.com/cgi-bin/
ErrorLog /home/test.com/logs/error_log
CustomLog /home/test.com/logs/access_log combined
</VirtualHost>
##############################################################################
VirtualHost No 2 "test1.com"
#################################################################
<VirtualHost 192.168.1.10>
ServerAdmin webmaster@test.com
DocumentRoot /home/test.com/htdocs
ServerName test.com
ServerAlias www.test.com
ScriptAlias /cgi-bin/ /home/test.com/cgi-bin/
ErrorLog /home/test.com/logs/error_log
CustomLog /home/test.com/logs/access_log combined
</VirtualHost>
##############################################################################
if I upload any php script with file open function
suppose in test.com
i can read the content of test1.com thought their
user and group are different
and also i can view the whole directory structure of
my server
I tired by giving "DocumetRoot ~" like this
but it is not working i am finding the solution but
can any body help me in this problme?
So it their any way from which i can stop this?
anybody can help in this?
Thanx in advance
__________________________________________________
Do you Yahoo!?
Faith Hill - Exclusive Performances, Videos & More
http://faith.yahoo.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Virtual Hosting security issues
Posted by Daniel Grace <ru...@earthlink.net>.
From: "sunil sharma" <ap...@yahoo.com>
To: <us...@httpd.apache.org>
Sent: Tuesday, October 15, 2002 10:44 PM
Subject: [users@httpd] Virtual Hosting security issues
> Hello Friend
>
> I am very worried about my virtual host security
> issues
>
> On my server their are near about 550 virtual host's
> are configured
>
[snip configuration example]
> if I upload any php script with file open function
> suppose in test.com
> i can read the content of test1.com thought their
> user and group are different
> and also i can view the whole directory structure of
> my server
>
> I tired by giving "DocumetRoot ~" like this
> but it is not working i am finding the solution but
> can any body help me in this problme?
> So it their any way from which i can stop this?
> anybody can help in this?
>
> Thanx in advance
This is the very reason I dont' have my own free-for-friends PHP hosting up
yet. It's a major security issue and the fix is kind of expensive.
SUexec works wonders for this, however, SUexec is only useful for situations
when you're running a CGI script, etc. It won't work for Apache modules, so
you need to use it with the PHP CGI module and may need to workaround for
any others you are using as well. The downside here is you either have to:
1 - Make a copy of the PHP CGI for each user (SUexec will only work if ONLY
the user it runs as can modify the file its running)
2 - Hack the SUexec code (despite all the warnings that scream "You really
ought to not modify this file") to remove the 'must-be-owner' restriction.
(I only recommend doing this if you understand the security complications
behind this -- most notably, giving your webserver user the ability to
effectively 'su' to most any user (SUexec will refuse to access a system
account or root.))
The far superior way (that might not work yet) would be to use the
still-experimental. Perchild MPM in Apache 2. This basically allows you to
bind each virtual host to its own user/group. Since the actual Apache
process runs as that user/group (instead of relying upon SUexec for
scripts), this works with modules as well as actual CGI binaries in the
webspace, and it allows you to make the entire WWW directory for that vhost
readable/writable by the owner and not by anybody else (if you choose to do
so). The downside is (if I'm not mistaken -- I don't know the specifics as
to how it works) you'll end up with at least one Apache process running as
each user (plus 1 to listen for connections and forward them to the right
connection, plus 1 that runs as root that creates new connections which in
turn setuid themselves). The downside is all your modules need to be
thread-safe, and Perchild may not actually be working yet and probably
should not be used on a production server. Track its progress at
http://cvs.apache.org/viewcvs.cgi/httpd-2.0/server/mpm/experimental/perchild
/perchild.c. If you opt to give this a try, let me know how it works out ;)
I tried this many many months ago and didn't have luck then, but Perchild
has evolved alot since then. If it works for you I'd like to know because
then I can start looking into it again myself.
-- Daniel Grace
Certified 99.9996% lurker
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
[users@httpd] help urgent
Posted by vaibhav verma <va...@tarangtech.com>.
Can i get an apache binary for MAC 9? If yes where?
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Virtual Hosting security issues
Posted by Eelco Alosery <in...@multi-graphics.nl>.
711 means owner can do all, and group and world can only exacute
so if the system owns a dir and a group or world want to index it, it
wil exacute and stops a groep from indexing the dir
Sander Holthaus heeft op donderdag, 17 okt 2002 om 01:07
(Europe/Amsterdam) het volgende geschreven:
> 711 means owners can do all, and group and the world can either
> execute files
> or read directories. I cannot see how this would? Also, doesn't such a
> settign (711) impair functionality of your scripts?
>
> Op Wednesday 16 October 2002 14:25, Eelco Alosery schreef:
>> I stopt users from reading other users directorys by making a
>> directory
>> like www andfor each user i make a new dir in this directory white a
>> unik name like my164dir.
>> The www directory I have chmod it to 0711 and this directory whil now
>> sho up white no result when indexing it tru a cgi script
>>
>> sunil sharma heeft op woensdag, 16 okt 2002 om 09:02
>> (Europe/Amsterdam)
>>
>> het volgende geschreven:
>>> First thanx for reply
>>> Ok if i stop from php then any body can view the
>>> directory structure by perl or cgi and if mod_jk is
>>> their then he can also read from jsp and class file
>>> also so we have to stop it at apache level
>>>
>>> Is their any kind of setting in httpd.conf like
>>> proftpd.conf where if you mention "DefaultRoot ~"
>>> like this then the user can not go into others
>>> directories this is the just thought which i got
>>>
>>> is this possible in apache's case if i mention
>>> DefautRoot ~ like this then its no any script can view
>>> others directory
>>>
>>> so is it possible?
>>>
>>> thanx again
>>>
>>> --- Gilles Gros <gi...@whitepj.com> wrote:
>>>> The problem is not apache, but PHP.
>>>>
>>>> look into the safe mode of PHP.
>>>> disabling some PHP function should help you .
>>>>
>>>> Gilles
>>>>
>>>>> -----Original Message-----
>>>>> From: sunil sharma [mailto:apache_fan@yahoo.com]
>>>>> Sent: Tuesday, October 15, 2002 11:45 PM
>>>>> To: users@httpd.apache.org
>>>>> Subject: [users@httpd] Virtual Hosting security
>>>>
>>>> issues
>>>>
>>>>> Hello Friend
>>>>>
>>>>> I am very worried about my virtual host security
>>>>> issues
>>>>>
>>>>> On my server their are near about 550 virtual
>>>>
>>>> host's
>>>>
>>>>> are configured
>>>>>
>>>>> folloing is the the of example of virtual hosts
>>>>
>>>> setup
>>>>
>>>>> on my server
>>>>>
>>>>> VirtualHost no 1 "test.com"
>>>
>>> #################################################################
>>>
>>>>> <VirtualHost 192.168.1.10>
>>>>> ServerAdmin webmaster@test.com
>>>>> DocumentRoot /home/test.com/htdocs
>>>>> ServerName test.com
>>>>> ServerAlias www.test.com
>>>>> ScriptAlias /cgi-bin/ /home/test.com/cgi-bin/
>>>>> ErrorLog /home/test.com/logs/error_log
>>>>> CustomLog /home/test.com/logs/access_log
>>>>
>>>> combined
>>>>
>>>>> </VirtualHost>
>>>
>>> ##################################################################
>>>
>>>>> ############
>>>>>
>>>>> VirtualHost No 2 "test1.com"
>>>
>>> #################################################################
>>>
>>>>> <VirtualHost 192.168.1.10>
>>>>> ServerAdmin webmaster@test.com
>>>>> DocumentRoot /home/test.com/htdocs
>>>>> ServerName test.com
>>>>> ServerAlias www.test.com
>>>>> ScriptAlias /cgi-bin/ /home/test.com/cgi-bin/
>>>>> ErrorLog /home/test.com/logs/error_log
>>>>> CustomLog /home/test.com/logs/access_log
>>>>
>>>> combined
>>>>
>>>>> </VirtualHost>
>>>
>>> ##################################################################
>>>
>>>>> ############
>>>>>
>>>>> if I upload any php script with file open function
>>>>> suppose in test.com
>>>>> i can read the content of test1.com thought their
>>>>> user and group are different
>>>>> and also i can view the whole directory structure
>>>>
>>>> of
>>>>
>>>>> my server
>>>>>
>>>>> I tired by giving "DocumetRoot ~" like this
>>>>> but it is not working i am finding the solution
>>>>
>>>> but
>>>>
>>>>> can any body help me in this problme?
>>>>> So it their any way from which i can stop this?
>>>>> anybody can help in this?
>>>>>
>>>>> Thanx in advance
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> __________________________________________________
>>>>> Do you Yahoo!?
>>>>> Faith Hill - Exclusive Performances, Videos & More
>>>>> http://faith.yahoo.com
>>>
>>> ---------------------------------------------------------------------
>>>
>>>>> The official User-To-User support forum of the
>>>>
>>>> Apache HTTP Server Project.
>>>>
>>>>> See <URL:http://httpd.apache.org/userslist.html>
>>>>
>>>> for more info.
>>>>
>>>>> To unsubscribe, e-mail:
>>>>
>>>> users-unsubscribe@httpd.apache.org
>>>>
>>>>> " from the digest:
>>>>
>>>> users-digest-unsubscribe@httpd.apache.org
>>>>
>>>>> For additional commands, e-mail:
>>>>
>>>> users-help@httpd.apache.org
>>>
>>> ---------------------------------------------------------------------
>>>
>>>> The official User-To-User support forum of the
>>>> Apache HTTP Server Project.
>>>> See <URL:http://httpd.apache.org/userslist.html> for
>>>> more info.
>>>> To unsubscribe, e-mail:
>>>> users-unsubscribe@httpd.apache.org
>>>> " from the digest:
>>>> users-digest-unsubscribe@httpd.apache.org
>>>> For additional commands, e-mail:
>>>> users-help@httpd.apache.org
>>>
>>> __________________________________________________
>>> Do you Yahoo!?
>>> Faith Hill - Exclusive Performances, Videos & More
>>> http://faith.yahoo.com
>>>
>>> ---------------------------------------------------------------------
>>> The official User-To-User support forum of the Apache HTTP Server
>>> Project.
>>> See <URL:http://httpd.apache.org/userslist.html> for more info.
>>> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>>> " from the digest: users-digest-unsubscribe@httpd.apache.org
>>> For additional commands, e-mail: users-help@httpd.apache.org
>>
>> Met vriendelijke groet,
>>
>> Multi-Graphics
>> Eelco Alosery
>> Koekoeksbloem 11
>> 8255 KH Swifterbant
>> Tel : 0321-380014
>> Fax : 0321-843340
>> info@multi-graphics.nl
>> www.multi-graphics.nl
>>
>>
>>
>> ---------------------------------------------------------------------
>> The official User-To-User support forum of the Apache HTTP Server
>> Project.
>> See <URL:http://httpd.apache.org/userslist.html> for more info.
>> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>> " from the digest: users-digest-unsubscribe@httpd.apache.org
>> For additional commands, e-mail: users-help@httpd.apache.org
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server
> Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
Met vriendelijke groet,
Multi-Graphics
Eelco Alosery
Koekoeksbloem 11
8255 KH Swifterbant
Tel : 0321-380014
Fax : 0321-843340
info@multi-graphics.nl
www.multi-graphics.nl
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Virtual Hosting security issues
Posted by Sander Holthaus <in...@orangexl.com>.
711 means owners can do all, and group and the world can either execute files
or read directories. I cannot see how this would? Also, doesn't such a
settign (711) impair functionality of your scripts?
Op Wednesday 16 October 2002 14:25, Eelco Alosery schreef:
> I stopt users from reading other users directorys by making a directory
> like www andfor each user i make a new dir in this directory white a
> unik name like my164dir.
> The www directory I have chmod it to 0711 and this directory whil now
> sho up white no result when indexing it tru a cgi script
>
> sunil sharma heeft op woensdag, 16 okt 2002 om 09:02 (Europe/Amsterdam)
>
> het volgende geschreven:
> > First thanx for reply
> > Ok if i stop from php then any body can view the
> > directory structure by perl or cgi and if mod_jk is
> > their then he can also read from jsp and class file
> > also so we have to stop it at apache level
> >
> > Is their any kind of setting in httpd.conf like
> > proftpd.conf where if you mention "DefaultRoot ~"
> > like this then the user can not go into others
> > directories this is the just thought which i got
> >
> > is this possible in apache's case if i mention
> > DefautRoot ~ like this then its no any script can view
> > others directory
> >
> > so is it possible?
> >
> > thanx again
> >
> > --- Gilles Gros <gi...@whitepj.com> wrote:
> >> The problem is not apache, but PHP.
> >>
> >> look into the safe mode of PHP.
> >> disabling some PHP function should help you .
> >>
> >> Gilles
> >>
> >>> -----Original Message-----
> >>> From: sunil sharma [mailto:apache_fan@yahoo.com]
> >>> Sent: Tuesday, October 15, 2002 11:45 PM
> >>> To: users@httpd.apache.org
> >>> Subject: [users@httpd] Virtual Hosting security
> >>
> >> issues
> >>
> >>> Hello Friend
> >>>
> >>> I am very worried about my virtual host security
> >>> issues
> >>>
> >>> On my server their are near about 550 virtual
> >>
> >> host's
> >>
> >>> are configured
> >>>
> >>> folloing is the the of example of virtual hosts
> >>
> >> setup
> >>
> >>> on my server
> >>>
> >>> VirtualHost no 1 "test.com"
> >
> > #################################################################
> >
> >>> <VirtualHost 192.168.1.10>
> >>> ServerAdmin webmaster@test.com
> >>> DocumentRoot /home/test.com/htdocs
> >>> ServerName test.com
> >>> ServerAlias www.test.com
> >>> ScriptAlias /cgi-bin/ /home/test.com/cgi-bin/
> >>> ErrorLog /home/test.com/logs/error_log
> >>> CustomLog /home/test.com/logs/access_log
> >>
> >> combined
> >>
> >>> </VirtualHost>
> >
> > ##################################################################
> >
> >>> ############
> >>>
> >>> VirtualHost No 2 "test1.com"
> >
> > #################################################################
> >
> >>> <VirtualHost 192.168.1.10>
> >>> ServerAdmin webmaster@test.com
> >>> DocumentRoot /home/test.com/htdocs
> >>> ServerName test.com
> >>> ServerAlias www.test.com
> >>> ScriptAlias /cgi-bin/ /home/test.com/cgi-bin/
> >>> ErrorLog /home/test.com/logs/error_log
> >>> CustomLog /home/test.com/logs/access_log
> >>
> >> combined
> >>
> >>> </VirtualHost>
> >
> > ##################################################################
> >
> >>> ############
> >>>
> >>> if I upload any php script with file open function
> >>> suppose in test.com
> >>> i can read the content of test1.com thought their
> >>> user and group are different
> >>> and also i can view the whole directory structure
> >>
> >> of
> >>
> >>> my server
> >>>
> >>> I tired by giving "DocumetRoot ~" like this
> >>> but it is not working i am finding the solution
> >>
> >> but
> >>
> >>> can any body help me in this problme?
> >>> So it their any way from which i can stop this?
> >>> anybody can help in this?
> >>>
> >>> Thanx in advance
> >>>
> >>>
> >>>
> >>>
> >>> __________________________________________________
> >>> Do you Yahoo!?
> >>> Faith Hill - Exclusive Performances, Videos & More
> >>> http://faith.yahoo.com
> >
> > ---------------------------------------------------------------------
> >
> >>> The official User-To-User support forum of the
> >>
> >> Apache HTTP Server Project.
> >>
> >>> See <URL:http://httpd.apache.org/userslist.html>
> >>
> >> for more info.
> >>
> >>> To unsubscribe, e-mail:
> >>
> >> users-unsubscribe@httpd.apache.org
> >>
> >>> " from the digest:
> >>
> >> users-digest-unsubscribe@httpd.apache.org
> >>
> >>> For additional commands, e-mail:
> >>
> >> users-help@httpd.apache.org
> >
> > ---------------------------------------------------------------------
> >
> >> The official User-To-User support forum of the
> >> Apache HTTP Server Project.
> >> See <URL:http://httpd.apache.org/userslist.html> for
> >> more info.
> >> To unsubscribe, e-mail:
> >> users-unsubscribe@httpd.apache.org
> >> " from the digest:
> >> users-digest-unsubscribe@httpd.apache.org
> >> For additional commands, e-mail:
> >> users-help@httpd.apache.org
> >
> > __________________________________________________
> > Do you Yahoo!?
> > Faith Hill - Exclusive Performances, Videos & More
> > http://faith.yahoo.com
> >
> > ---------------------------------------------------------------------
> > The official User-To-User support forum of the Apache HTTP Server
> > Project.
> > See <URL:http://httpd.apache.org/userslist.html> for more info.
> > To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> > " from the digest: users-digest-unsubscribe@httpd.apache.org
> > For additional commands, e-mail: users-help@httpd.apache.org
>
> Met vriendelijke groet,
>
> Multi-Graphics
> Eelco Alosery
> Koekoeksbloem 11
> 8255 KH Swifterbant
> Tel : 0321-380014
> Fax : 0321-843340
> info@multi-graphics.nl
> www.multi-graphics.nl
>
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Virtual Hosting security issues
Posted by Eelco Alosery <in...@multi-graphics.nl>.
I stopt users from reading other users directorys by making a directory
like www andfor each user i make a new dir in this directory white a
unik name like my164dir.
The www directory I have chmod it to 0711 and this directory whil now
sho up white no result when indexing it tru a cgi script
sunil sharma heeft op woensdag, 16 okt 2002 om 09:02 (Europe/Amsterdam)
het volgende geschreven:
> First thanx for reply
> Ok if i stop from php then any body can view the
> directory structure by perl or cgi and if mod_jk is
> their then he can also read from jsp and class file
> also so we have to stop it at apache level
>
> Is their any kind of setting in httpd.conf like
> proftpd.conf where if you mention "DefaultRoot ~"
> like this then the user can not go into others
> directories this is the just thought which i got
>
> is this possible in apache's case if i mention
> DefautRoot ~ like this then its no any script can view
> others directory
>
> so is it possible?
>
> thanx again
>
>
> --- Gilles Gros <gi...@whitepj.com> wrote:
>> The problem is not apache, but PHP.
>>
>> look into the safe mode of PHP.
>> disabling some PHP function should help you .
>>
>> Gilles
>>
>>> -----Original Message-----
>>> From: sunil sharma [mailto:apache_fan@yahoo.com]
>>> Sent: Tuesday, October 15, 2002 11:45 PM
>>> To: users@httpd.apache.org
>>> Subject: [users@httpd] Virtual Hosting security
>> issues
>>>
>>>
>>> Hello Friend
>>>
>>> I am very worried about my virtual host security
>>> issues
>>>
>>> On my server their are near about 550 virtual
>> host's
>>> are configured
>>>
>>> folloing is the the of example of virtual hosts
>> setup
>>> on my server
>>>
>>> VirtualHost no 1 "test.com"
>>>
>>>
>>
> #################################################################
>>> <VirtualHost 192.168.1.10>
>>> ServerAdmin webmaster@test.com
>>> DocumentRoot /home/test.com/htdocs
>>> ServerName test.com
>>> ServerAlias www.test.com
>>> ScriptAlias /cgi-bin/ /home/test.com/cgi-bin/
>>> ErrorLog /home/test.com/logs/error_log
>>> CustomLog /home/test.com/logs/access_log
>> combined
>>> </VirtualHost>
>>>
>>
> ##################################################################
>>> ############
>>>
>>> VirtualHost No 2 "test1.com"
>>>
>>
> #################################################################
>>> <VirtualHost 192.168.1.10>
>>> ServerAdmin webmaster@test.com
>>> DocumentRoot /home/test.com/htdocs
>>> ServerName test.com
>>> ServerAlias www.test.com
>>> ScriptAlias /cgi-bin/ /home/test.com/cgi-bin/
>>> ErrorLog /home/test.com/logs/error_log
>>> CustomLog /home/test.com/logs/access_log
>> combined
>>> </VirtualHost>
>>>
>>
> ##################################################################
>>> ############
>>>
>>> if I upload any php script with file open function
>>> suppose in test.com
>>> i can read the content of test1.com thought their
>>> user and group are different
>>> and also i can view the whole directory structure
>> of
>>> my server
>>>
>>> I tired by giving "DocumetRoot ~" like this
>>> but it is not working i am finding the solution
>> but
>>> can any body help me in this problme?
>>> So it their any way from which i can stop this?
>>> anybody can help in this?
>>>
>>> Thanx in advance
>>>
>>>
>>>
>>>
>>> __________________________________________________
>>> Do you Yahoo!?
>>> Faith Hill - Exclusive Performances, Videos & More
>>> http://faith.yahoo.com
>>>
>>>
>>
> ---------------------------------------------------------------------
>>> The official User-To-User support forum of the
>> Apache HTTP Server Project.
>>> See <URL:http://httpd.apache.org/userslist.html>
>> for more info.
>>> To unsubscribe, e-mail:
>> users-unsubscribe@httpd.apache.org
>>> " from the digest:
>> users-digest-unsubscribe@httpd.apache.org
>>> For additional commands, e-mail:
>> users-help@httpd.apache.org
>>>
>>>
>>
>>
>>
> ---------------------------------------------------------------------
>> The official User-To-User support forum of the
>> Apache HTTP Server Project.
>> See <URL:http://httpd.apache.org/userslist.html> for
>> more info.
>> To unsubscribe, e-mail:
>> users-unsubscribe@httpd.apache.org
>> " from the digest:
>> users-digest-unsubscribe@httpd.apache.org
>> For additional commands, e-mail:
>> users-help@httpd.apache.org
>>
>
>
> __________________________________________________
> Do you Yahoo!?
> Faith Hill - Exclusive Performances, Videos & More
> http://faith.yahoo.com
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server
> Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
Met vriendelijke groet,
Multi-Graphics
Eelco Alosery
Koekoeksbloem 11
8255 KH Swifterbant
Tel : 0321-380014
Fax : 0321-843340
info@multi-graphics.nl
www.multi-graphics.nl
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] Virtual Hosting security issues
Posted by sunil sharma <ap...@yahoo.com>.
First thanx for reply
Ok if i stop from php then any body can view the
directory structure by perl or cgi and if mod_jk is
their then he can also read from jsp and class file
also so we have to stop it at apache level
Is their any kind of setting in httpd.conf like
proftpd.conf where if you mention "DefaultRoot ~"
like this then the user can not go into others
directories this is the just thought which i got
is this possible in apache's case if i mention
DefautRoot ~ like this then its no any script can view
others directory
so is it possible?
thanx again
--- Gilles Gros <gi...@whitepj.com> wrote:
> The problem is not apache, but PHP.
>
> look into the safe mode of PHP.
> disabling some PHP function should help you .
>
> Gilles
>
> > -----Original Message-----
> > From: sunil sharma [mailto:apache_fan@yahoo.com]
> > Sent: Tuesday, October 15, 2002 11:45 PM
> > To: users@httpd.apache.org
> > Subject: [users@httpd] Virtual Hosting security
> issues
> >
> >
> > Hello Friend
> >
> > I am very worried about my virtual host security
> > issues
> >
> > On my server their are near about 550 virtual
> host's
> > are configured
> >
> > folloing is the the of example of virtual hosts
> setup
> > on my server
> >
> > VirtualHost no 1 "test.com"
> >
> >
>
#################################################################
> > <VirtualHost 192.168.1.10>
> > ServerAdmin webmaster@test.com
> > DocumentRoot /home/test.com/htdocs
> > ServerName test.com
> > ServerAlias www.test.com
> > ScriptAlias /cgi-bin/ /home/test.com/cgi-bin/
> > ErrorLog /home/test.com/logs/error_log
> > CustomLog /home/test.com/logs/access_log
> combined
> > </VirtualHost>
> >
>
##################################################################
> > ############
> >
> > VirtualHost No 2 "test1.com"
> >
>
#################################################################
> > <VirtualHost 192.168.1.10>
> > ServerAdmin webmaster@test.com
> > DocumentRoot /home/test.com/htdocs
> > ServerName test.com
> > ServerAlias www.test.com
> > ScriptAlias /cgi-bin/ /home/test.com/cgi-bin/
> > ErrorLog /home/test.com/logs/error_log
> > CustomLog /home/test.com/logs/access_log
> combined
> > </VirtualHost>
> >
>
##################################################################
> > ############
> >
> > if I upload any php script with file open function
> > suppose in test.com
> > i can read the content of test1.com thought their
> > user and group are different
> > and also i can view the whole directory structure
> of
> > my server
> >
> > I tired by giving "DocumetRoot ~" like this
> > but it is not working i am finding the solution
> but
> > can any body help me in this problme?
> > So it their any way from which i can stop this?
> > anybody can help in this?
> >
> > Thanx in advance
> >
> >
> >
> >
> > __________________________________________________
> > Do you Yahoo!?
> > Faith Hill - Exclusive Performances, Videos & More
> > http://faith.yahoo.com
> >
> >
>
---------------------------------------------------------------------
> > The official User-To-User support forum of the
> Apache HTTP Server Project.
> > See <URL:http://httpd.apache.org/userslist.html>
> for more info.
> > To unsubscribe, e-mail:
> users-unsubscribe@httpd.apache.org
> > " from the digest:
> users-digest-unsubscribe@httpd.apache.org
> > For additional commands, e-mail:
> users-help@httpd.apache.org
> >
> >
>
>
>
---------------------------------------------------------------------
> The official User-To-User support forum of the
> Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for
> more info.
> To unsubscribe, e-mail:
> users-unsubscribe@httpd.apache.org
> " from the digest:
> users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail:
> users-help@httpd.apache.org
>
__________________________________________________
Do you Yahoo!?
Faith Hill - Exclusive Performances, Videos & More
http://faith.yahoo.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] Virtual Hosting security issues
Posted by Gilles Gros <gi...@whitepj.com>.
The problem is not apache, but PHP.
look into the safe mode of PHP.
disabling some PHP function should help you .
Gilles
> -----Original Message-----
> From: sunil sharma [mailto:apache_fan@yahoo.com]
> Sent: Tuesday, October 15, 2002 11:45 PM
> To: users@httpd.apache.org
> Subject: [users@httpd] Virtual Hosting security issues
>
>
> Hello Friend
>
> I am very worried about my virtual host security
> issues
>
> On my server their are near about 550 virtual host's
> are configured
>
> folloing is the the of example of virtual hosts setup
> on my server
>
> VirtualHost no 1 "test.com"
>
> #################################################################
> <VirtualHost 192.168.1.10>
> ServerAdmin webmaster@test.com
> DocumentRoot /home/test.com/htdocs
> ServerName test.com
> ServerAlias www.test.com
> ScriptAlias /cgi-bin/ /home/test.com/cgi-bin/
> ErrorLog /home/test.com/logs/error_log
> CustomLog /home/test.com/logs/access_log combined
> </VirtualHost>
> ##################################################################
> ############
>
> VirtualHost No 2 "test1.com"
> #################################################################
> <VirtualHost 192.168.1.10>
> ServerAdmin webmaster@test.com
> DocumentRoot /home/test.com/htdocs
> ServerName test.com
> ServerAlias www.test.com
> ScriptAlias /cgi-bin/ /home/test.com/cgi-bin/
> ErrorLog /home/test.com/logs/error_log
> CustomLog /home/test.com/logs/access_log combined
> </VirtualHost>
> ##################################################################
> ############
>
> if I upload any php script with file open function
> suppose in test.com
> i can read the content of test1.com thought their
> user and group are different
> and also i can view the whole directory structure of
> my server
>
> I tired by giving "DocumetRoot ~" like this
> but it is not working i am finding the solution but
> can any body help me in this problme?
> So it their any way from which i can stop this?
> anybody can help in this?
>
> Thanx in advance
>
>
>
>
> __________________________________________________
> Do you Yahoo!?
> Faith Hill - Exclusive Performances, Videos & More
> http://faith.yahoo.com
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org