You are viewing a plain text version of this content. The canonical link for it is here.
Posted to modperl@perl.apache.org by Perrin Harkins <pe...@elem.com> on 2004/05/03 18:48:18 UTC
Re: mod_perl File Extension Configuration instead of a Path
Configuration
On Mon, 2004-05-03 at 12:39, JupiterHost.Net wrote:
> IE: it would be just as dangerouse as running a regular perl or shell or
> OTHER_LANGUAGE_HERE script in their home dir, correct?
[...]
> mod_perl scripts are run with the permissions of the user correct?
> IE if Apache its 'nobody' or otherwsie (getpwuid($>))[0]
No, when you run things with mod_perl, they run in the apache server
process. They will always have the same permissions as the apache
server. It is not safe to run untrusted scripts under mod_perl. (There
is all kinds of hand-waving about using Safe or something, but the only
thing I would trust is an entirely separate server running as an
unprivileged user.)
More info on configuration options is available here:
http://perl.apache.org/docs/1.0/guide/config.html
If you want to just run .pl scripts under specific directories through
mod_perl, the docs there will tell you how (using a <FilesMatch>
directive).
- Perrin
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: mod_perl File Extension Configuration instead of a Path Configuration
Posted by "JupiterHost.Net" <ml...@jupiterhost.net>.
Perrin Harkins wrote:
> On Mon, 2004-05-03 at 17:24, JupiterHost.Net wrote:
>
>>So if I did it the .mpl way then /usr/foo/bar.mpl and /usr/foo/baz.mpl
>>will run as nobody (IE untrusted user with less privileges)
>
>
> If that's who your server runs as, then yes. The "nobody" user has the
> same privileges as any other user the systems I'm familiar with. That
> user typically has no login, but may have permission to write to certain
> directories, etc.
cool, gotcha
>>(Regular .pl scripts currently run under suexec which I know mod_perl
>>can't do since you can't split up a single process like that, will that
>>hiinder mod_perl from running?)
>
>
> I'm not sure what you're asking. If you add something to your conf to
> make all of your .pl scripts run through mod_perl, they won't run
> through suexec anymore. You would have to keep them as CGI for that to
> work. If you set it up to run some directories through CGI and some
> through mod_perl, that will work fine.
That's it exactly :)
If .pl run as regular scripts under suexec they'll be run as 'foo'
instead of 'nobody' but any mod_perl scripts will be run as 'nobody'
but neither will break the other...
>>Which is just as [in]secure as /home/foo/bar.pl ,
>>/home/foo/stuff/baz.sh, /home/foo/public_html/luz.py, correct?
>
>
> Running them under mod_perl is less secure in the sense that anyone can
> write a script that messes around with globals, redefines core perl
> fuctions, etc. and messes up other people's scripts, since they are all
> running in the same interpreter. You really should not run untrusted
> code under mod_perl without isolating it to its own apache server.
I see, perhaps I need to look into setting it up to run theri own
mod_perl apache so they can shoot them self in the foot instead of others :)
>>(Maybe more secure since 'nobody' has less privs than 'foo', correct?)
>
>
> Again, "nobody" is just another user.
>
> - Perrin
Thanks for the great info!
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: mod_perl File Extension Configuration instead of a
Path Configuration
Posted by Perrin Harkins <pe...@elem.com>.
On Mon, 2004-05-03 at 17:24, JupiterHost.Net wrote:
> So if I did it the .mpl way then /usr/foo/bar.mpl and /usr/foo/baz.mpl
> will run as nobody (IE untrusted user with less privileges)
If that's who your server runs as, then yes. The "nobody" user has the
same privileges as any other user the systems I'm familiar with. That
user typically has no login, but may have permission to write to certain
directories, etc.
> (Regular .pl scripts currently run under suexec which I know mod_perl
> can't do since you can't split up a single process like that, will that
> hiinder mod_perl from running?)
I'm not sure what you're asking. If you add something to your conf to
make all of your .pl scripts run through mod_perl, they won't run
through suexec anymore. You would have to keep them as CGI for that to
work. If you set it up to run some directories through CGI and some
through mod_perl, that will work fine.
> Which is just as [in]secure as /home/foo/bar.pl ,
> /home/foo/stuff/baz.sh, /home/foo/public_html/luz.py, correct?
Running them under mod_perl is less secure in the sense that anyone can
write a script that messes around with globals, redefines core perl
fuctions, etc. and messes up other people's scripts, since they are all
running in the same interpreter. You really should not run untrusted
code under mod_perl without isolating it to its own apache server.
> (Maybe more secure since 'nobody' has less privs than 'foo', correct?)
Again, "nobody" is just another user.
- Perrin
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: mod_perl File Extension Configuration instead of a Path Configuration
Posted by "JupiterHost.Net" <ml...@jupiterhost.net>.
Thanks for your input! I really appreciate it!
Perrin Harkins wrote:
> On Mon, 2004-05-03 at 12:39, JupiterHost.Net wrote:
>
>>IE: it would be just as dangerouse as running a regular perl or shell or
>>OTHER_LANGUAGE_HERE script in their home dir, correct?
>
> [...]
>
>>mod_perl scripts are run with the permissions of the user correct?
>>IE if Apache its 'nobody' or otherwsie (getpwuid($>))[0]
>
>
> No, when you run things with mod_perl, they run in the apache server
> process. They will always have the same permissions as the apache
So if I did it the .mpl way then /usr/foo/bar.mpl and /usr/foo/baz.mpl
will run as nobody (IE untrusted user with less privileges)
(Regular .pl scripts currently run under suexec which I know mod_perl
can't do since you can't split up a single process like that, will that
hiinder mod_perl from running?)
Which is just as [in]secure as /home/foo/bar.pl ,
/home/foo/stuff/baz.sh, /home/foo/public_html/luz.py, correct?
(Maybe more secure since 'nobody' has less privs than 'foo', correct?)
> server. It is not safe to run untrusted scripts under mod_perl. (There
> is all kinds of hand-waving about using Safe or something, but the only
> thing I would trust is an entirely separate server running as an
> unprivileged user.)
>
> More info on configuration options is available here:
> http://perl.apache.org/docs/1.0/guide/config.html
I'll definately take a look thanks!
> If you want to just run .pl scripts under specific directories through
> mod_perl, the docs there will tell you how (using a <FilesMatch>
> directive).
Oh, good idea! then I can limit it to cgi-bin and .mpl... hmmmm excellent :)
> - Perrin
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html