Re^4: CGI (in)security

Thanks, jeffa!

I had the impression that, with the appropriate directory settings (701), the users in the group aren't able to peek at what's in your directory. Am I missing something here?

Comment on Re^4: CGI (in)security

Replies are listed 'Best First'.
Re^5: CGI (in)security by jeffa (Bishop) on Jun 15, 2004 at 16:30 UTC
That indeed keeps them from peeking into the directory, but that doesn't keep them from accessing the file if they know the name ahead of time. And where do they get the name? From the script that opens it for reading, and that script is in the cgi-bin directory for your web site. Now the problem is that the web server executing the script has to have permission to read the password file, so you can't just chmod the file (presumable owned by you) to 600 ... unless you have root. Then you can chown the file to the web server, preventing other local users from viewing it (unless they have root too). jeffa L-LL-L--L-LL-L--L-LL-L-- -R--R-RR-R--R-RR-R--R-RR B--B--B--B--B--B--B--B-- H---H---H---H---H---H--- (the triplet paradiddle with high-hat)	[reply]

Replies are listed 'Best First'.

Re^5: CGI (in)security
by jeffa (Bishop) on Jun 15, 2004 at 16:30 UTC

That indeed keeps them from peeking into the directory, but that doesn't keep them from accessing the file if they know the name ahead of time. And where do they get the name? From the script that opens it for reading, and that script is in the cgi-bin directory for your web site. Now the problem is that the web server executing the script has to have permission to read the password file, so you can't just chmod the file (presumable owned by you) to 600 ... unless you have root. Then you can chown the file to the web server, preventing other local users from viewing it (unless they have root too).

jeffa

L-LL-L--L-LL-L--L-LL-L--
-R--R-RR-R--R-RR-R--R-RR
B--B--B--B--B--B--B--B--
H---H---H---H---H---H---
(the triplet paradiddle with high-hat)

[reply]