suEXEC and /etc/passwd

[Bob Bell <bo...@zk3.dec.com>]

Developers,

I first posed a question to the users list, and it was recommended that I ask
"the apache developers", which I assumed means ask here.

Quick overview:
I was to use suEXEC with a UID that doesn't have a corresponding username in
/etc/passwd, which suEXEC disallows.  Why? Can I disable that without modifying
source?  If I rip out that check, how I am vulernable?

More context:
I'm running an Ensim-based site with name-based virtual hosts.  suEXEC
is in use.  I want to make the web directories for those hosts
(including cgi-bin directories) owned by a different user than the Ensim
"site administrator".  That is, I want to make them owned by the
"webmaster" user for that domain.  Actually accomplishing that, and
serving static pages and providing FTP access, etc. is not a problem
(which is why I'm not posting to an Ensim list).

The problem is that that user is in the /etc/passwd file for that domain only,
not in the global /etc/passwd file for the system, which is what suEXEC checks.
 From http://httpd.apache.org/docs/suexec.html, a condition for success in
suEXEC is:
    5. Is the target user name valid?
        Does the target user exist?

I would like to know how to disable this check.  Do I have to comment
out the lines implementing it in the suEXEC source and recompile?  What
kind of problems do I open myself up to if I do?  (I can't think of any,
as long as the other checks are all in place, and I'm a reasonably
security-minded guy)

-- 
Bob Bell <bo...@zk3.dec.com>
-------------------------------------------------------------------------
 "Q. I find this a nice feature but it is not according to the
     documentation.  Or is it a BUG?
  A. Let's call it an accidental feature. :-)"
   -- Larry Wall, creator of the Perl programming language

Re: suEXEC and /etc/passwd

[Bob Bell <bo...@zk3.dec.com>]

On Wed, Feb 05, 2003 at 12:07:43AM +0100, André Malo <nd...@perlig.de> wrote:
> * Bob Bell wrote:
> > The problem is that that user is in the /etc/passwd file for that
> > domain only, not in the global /etc/passwd file for the system,
> > which is what suEXEC checks.  From
> > http://httpd.apache.org/docs/suexec.html, a condition for success in
> > suEXEC is:
> >     5. Is the target user name valid?
> >         Does the target user exist?
> 
> What does that mean? Is that domain chrooted?

    Yes, at least many activities for the domain take place in
a chrooted environment.  The domain has it's own /etc/passwd, separate
from the global /etc/passwd.

> I don't know whether setuid(2) works without a valid system user.

    After someone alluded to this on the users list, I wrote a short
program and verified that this does indeed work.

> > I would like to know how to disable this check.  Do I have to comment
> > out the lines implementing it in the suEXEC source and recompile?  What
> > kind of problems do I open myself up to if I do?  (I can't think of any,
> > as long as the other checks are all in place, and I'm a reasonably
> > security-minded guy)
> 
> You're loosing some control anyway. AFAICS, simply commenting the code out 
> is not sufficient, since the rest of suexec relies on the filled pw 
> structure, so you have to rewrite it, too. Perhaps using 
> <http://cgiwrap.unixtools.org/intro.html> is the better choice for you.

    I'd really like to use suEXEC, if possible.  Running as a UID that
doesn't have a corresponding username in /etc/passwd shouldn't pose
a security problem, as the same security restrictions still apply.  The
security checks are all really based on UID anyway; usernames in
/etc/passwd are analogous to DNS names for IP addresses.

    If I were to take the time to make suexec independent of the pw
structure, would there be any interest?  (I'm not sure if I will, as
I don't have the familiarity with httpd or suexec development, nor am
I sure I have the time)

-- 
Bob Bell <bo...@zk3.dec.com>
-------------------------------------------------------------------------
 "Tell a man there are 300 billion stars in the universe and he'll
  believe you. Tell him a bench has wet paint on it and he'll have
  to touch to be sure."
   -- Jarger

Re: suEXEC and /etc/passwd

[André Malo <nd...@perlig.de>]

* Bob Bell wrote:

> The problem is that that user is in the /etc/passwd file for that domain only,
> not in the global /etc/passwd file for the system, which is what suEXEC checks.
>  From http://httpd.apache.org/docs/suexec.html, a condition for success in
> suEXEC is:
>     5. Is the target user name valid?
>         Does the target user exist?

What does that mean? Is that domain chrooted?
I don't know whether setuid(2) works without a valid system user.

> I would like to know how to disable this check.  Do I have to comment
> out the lines implementing it in the suEXEC source and recompile?  What
> kind of problems do I open myself up to if I do?  (I can't think of any,
> as long as the other checks are all in place, and I'm a reasonably
> security-minded guy)

You're loosing some control anyway. AFAICS, simply commenting the code out 
is not sufficient, since the rest of suexec relies on the filled pw 
structure, so you have to rewrite it, too. Perhaps using 
<http://cgiwrap.unixtools.org/intro.html> is the better choice for you.

nd
-- 
"Eine Eieruhr", erklärt ihr Hermann, "besteht aus einem Ei. Du nimmst
das Ei und kochst es. Wenn es hart ist, sind fünf Minuten um. Dann weißt
du, daß die Zeit vergangen ist."
                             -- Hannes Hüttner in "Das Blaue vom Himmel"