[users@httpd] Security

[Jan-Pieter van den Heuvel <ja...@piozum.com>]

Hi everybody,

I'm running a webserver for multiple websites. Users can upload the
content to the server via FTP. When a user uses the MySQL database, it
must specify its username and password in a file. How do I prevent one
user to read the password of another user?

It can't be done by FTP: they only have access to their own files. But a
user can write a PHP-script (or CGI) that reads the contents of a file
from the website of another user! That means a user can read someone
else's password! Is there a way to prevent this?


Regards,

Jan-Pieter van den Heuvel

BTW I'm using RedHat Linux 7.3 with apache 1.3.23.


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org