You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by je...@digitalssg.net on 2003/09/17 11:57:10 UTC
[users@httpd] Using SuExec with mod_vhost_alias
Hi,
I was wondering if SuExec will work properly with mod_vhost_alias?
I configured and compiled apache with both successfully (see below for
my config options).
When I try and run a Perl CGI that is owned by a user other that that of
the httpd process, it doesnt run as that user.
All my virtual hosts are located in /home/httpd; i.e.
/home/httpd/domainone.com
/home/httpd/domaintwo.com
All the VirtualDocumentRoot's are chowned to thier respective UID/GID's
(not apache's UID).
In my httpd.conf I have this for the vhost_alias stuff:
VirtualDocumentRoot /home/httpd/%0/docs
VirtualScriptAlias /home/httpd/%0/cgi-bin
Here is what I configured Apache 1.3.28 with:
./configure --with-layout=RedHat \
--enable-module=vhost_alias \
--enable-module=include \
--activate-module=src/modules/php4/libphp4.a \
--add-module=mod_frontpage.c \
--activate-module=src/modules/sql/mod_log_sql.o \
--enable-suexec \
--suexec-caller=80 \
--suexec-docroot=/home/httpd \
--suexec-userdir=/home/httpd/* \
--suexec-logfile=/var/log/httpd/suexec.log \
--suexec-safepath="/bin:/usr/bin:/usr/sbin" \
--add-module=../mod_throttle-3.1.2/mod_throttle.c
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Using SuExec with mod_vhost_alias
Posted by Joshua Slive <jo...@slive.ca>.
On Fri, 19 Sep 2003, Jess Mahan wrote:
> Wich systems allow users to give away chown?
>
Many older sysv systems had this as a default. Others have it as a
configurable option. (Posix.1 apparently says either behavior is
allowed.)
I'm not sure if any modern unix comes with that behavior as the default,
but I wouldn't be surprised.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Using SuExec with mod_vhost_alias
Posted by Jess Mahan <je...@digitalssg.net>.
Wich systems allow users to give away chown?
On Sun, 2003-10-19 at 08:10, Joshua Slive wrote:
>
> On Thu, 18 Sep 2003 jess@digitalssg.net wrote:
> > Couldn't suexec just stat() the file being executed and setuid()
> > setgid() to that UID/GID?
>
> This would be a HUGE security hole on systems that allow users to give
> away ownership using chown. (Most systems don't do that anymore,
> but suexec needs to be safe everywhere.)
>
> In any case, it would be a major change to the security model of suexec,
> and playing with suexec is a dangerous thing to do.
>
> Joshua.
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Using SuExec with mod_vhost_alias
Posted by Joshua Slive <jo...@slive.ca>.
On Thu, 18 Sep 2003 jess@digitalssg.net wrote:
> Couldn't suexec just stat() the file being executed and setuid()
> setgid() to that UID/GID?
This would be a HUGE security hole on systems that allow users to give
away ownership using chown. (Most systems don't do that anymore,
but suexec needs to be safe everywhere.)
In any case, it would be a major change to the security model of suexec,
and playing with suexec is a dangerous thing to do.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Using SuExec with mod_vhost_alias
Posted by je...@digitalssg.net.
On Thu, Sep 18, 2003 at 09:56:11AM -0400, Joshua Slive wrote:
>
> On Thu, 18 Sep 2003, Robert Andersson wrote:
>
> > jess@digitalssg.net wrote:
> > > It's unfortunate that suexec does not work with vhost_alias.
> >
> > This lies outside the scope of SuExec's problem domain. As Jushua said, the
> > purpose of SuExec is to run script under the user/group given to a
> > VirtualHost.
> >
> > Without too much knowledge about it, I would guess that the change would be
> > more appropriate in mod_vhost_alias, so that it would provide a mechanism to
> > set a uid/gid for every host necessary and thus mimic a normal virtual host
> > including the uid/gid, which SuExec then could use.
>
> Note that this would require some mechanism for mapping from virtual host
> to userid. And I can't imagine any such mechanism which would be flexible
> enough, and at the same time secure enough to use. mod_vhost_alias
> depends too much on user input, which is something that suexec needs to be
> very careful about.
>
> >
> > > Does cgiwrap work for all cgi? shell, perl and C?
>
> Yes.
>
> Joshua.
Couldn't suexec just stat() the file being executed and setuid()
setgid() to that UID/GID?
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Using SuExec with mod_vhost_alias
Posted by Joshua Slive <jo...@slive.ca>.
On Thu, 18 Sep 2003, Robert Andersson wrote:
> jess@digitalssg.net wrote:
> > It's unfortunate that suexec does not work with vhost_alias.
>
> This lies outside the scope of SuExec's problem domain. As Jushua said, the
> purpose of SuExec is to run script under the user/group given to a
> VirtualHost.
>
> Without too much knowledge about it, I would guess that the change would be
> more appropriate in mod_vhost_alias, so that it would provide a mechanism to
> set a uid/gid for every host necessary and thus mimic a normal virtual host
> including the uid/gid, which SuExec then could use.
Note that this would require some mechanism for mapping from virtual host
to userid. And I can't imagine any such mechanism which would be flexible
enough, and at the same time secure enough to use. mod_vhost_alias
depends too much on user input, which is something that suexec needs to be
very careful about.
>
> > Does cgiwrap work for all cgi? shell, perl and C?
Yes.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Using SuExec with mod_vhost_alias
Posted by Robert Andersson <ro...@profundis.nu>.
jess@digitalssg.net wrote:
> It's unfortunate that suexec does not work with vhost_alias.
This lies outside the scope of SuExec's problem domain. As Jushua said, the
purpose of SuExec is to run script under the user/group given to a
VirtualHost.
Without too much knowledge about it, I would guess that the change would be
more appropriate in mod_vhost_alias, so that it would provide a mechanism to
set a uid/gid for every host necessary and thus mimic a normal virtual host
including the uid/gid, which SuExec then could use.
> Does cgiwrap work for all cgi? shell, perl and C?
I have not used cgiwrap, but I see no reason why any distinction would exist
as long as the *file* is executable by the system.
Regards,
Robert Andersson
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Using SuExec with mod_vhost_alias
Posted by je...@digitalssg.net.
On Wed, Sep 17, 2003 at 10:57:49PM -0400, Joshua Slive wrote:
>
> On Wed, 17 Sep 2003 jess@digitalssg.net wrote:
> > I was wondering if SuExec will work properly with mod_vhost_alias?
> >
>
> No. suexec triggers either from the UserDir directive (for ~user) or from
> a User/Group directive (SuexecUserGroup in 2.0) placed inside a
> <VirtualHost>. Since you have no <VirtualHost> section, you can't specify
> the user, and therefore suexec won't work.
>
> You may want to look at cgiwrap which may have a little more flexibility.
>
> Joshua.
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
I appreciate the response. It's unfortunate that suexec does not work
with vhost_alias. Is there a plan to incorporate this into apache? If
not I would be happy to work on it, if someone would point in the right
direction.
Does cgiwrap work for all cgi? shell, perl and C?
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Using SuExec with mod_vhost_alias
Posted by Joshua Slive <jo...@slive.ca>.
On Wed, 17 Sep 2003 jess@digitalssg.net wrote:
> I was wondering if SuExec will work properly with mod_vhost_alias?
>
No. suexec triggers either from the UserDir directive (for ~user) or from
a User/Group directive (SuexecUserGroup in 2.0) placed inside a
<VirtualHost>. Since you have no <VirtualHost> section, you can't specify
the user, and therefore suexec won't work.
You may want to look at cgiwrap which may have a little more flexibility.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org