[8112] in www-talk@info.cern.ch
Re: Private CGI-dir - a security risk
daemon@ATHENA.MIT.EDU (Gerald W. Edgar)
Mon May 1 22:09:44 1995
Date: Mon, 1 May 1995 22:08:28 +0500
Errors-To: procmaster@www19.w3.org
Reply-To: gwe3409@drtn009.ca.boeing.com
From: "Gerald W. Edgar" <gwe3409@drtn009.ca.boeing.com>
To: Multiple recipients of list <www-talk@www10.w3.org>
In one note about CGI from Vidar Madsen a mension that a CGI may
overwrite files that the "webmaster" account owns. This may include
configuration files.
There is a simple solution. Have the httpd run under a second
userid/groupid.
Permission could be given to read the configuration
file, but since the daemon executes under another account
it would not have permission by default to destroy the files.
In this situation one must be careful to give appropriate
permission to directories and files for public read and execute
permission only as needed. One must exercize caution in giving write
privilages.
Gerald Edgar
"My opinions"
