how to avoid web server from getting hacked

Niner710 has asked for the wisdom of the Perl Monks concerning the following question:

I am setting up a fedora web server and have an html form that when clicked will call test.cgi. Test.cgi will then write to a crontab. My problem is that my cgi script(var/www/cgi-bin/test.cgi) does not write to my crontab file(home/jma/Documents/cron-tab) at all. Permissions for my test.cgi file is 755. Permissions for my cron-tab file is 777(I know I should change this but just trying it for now so I can write to it).
Code for test.cgi

#!/usr/bin/perl
use CGI;
print "Content-type: text/html\n\n";
open(OUT, ">>/home/jma/Documents/cron-job");
print OUT "blah\n";
[download]

Can anyone tell me what I am doing wrong and why test.cgi does not write to cron-tab correctly?? I guess this is probably not the safest way to process the data. I've been hearing that I shouldn't write directly to a crontab file. Can anyone tell me an easier way to do this? Thanks!

Comment on how to avoid web server from getting hacked Download Code

Replies are listed 'Best First'.
Re: cgi script write to crontab by moritz (Cardinal) on May 13, 2008 at 20:25 UTC
Can anyone tell me what I am doing wrong?? You're not checking the success status of your system calls: `use strict; use warnings; use Fatal qw(:void open close print); use CGI; use CGI::Carp qw(fatalsToBrowser); print "Content-type: text/html\n\n"; open(OUT, ">>/home/jma/Documents/cron-job") or die "Can't open file fo +r writing: $!"; print OUT "blah\n"; close OUT;` [download]	[reply] [d/l]
Re^2: cgi script write to crontab by Niner710 (Sexton) on May 13, 2008 at 22:38 UTC
When I implemented your code, it said that I "Can't open file for writing. Permission denied at /var/www/cgi-bin/test.cgi line 9". Line 9 is this line... `open(OUT, ">>/home/jma/Documents/cron-job") or die "Can't open file fo +r writing: $!";` [download] My cron-job file is set to 777(just for test purposes) though. Why would my permissions be denied?	[reply] [d/l]
Re^3: cgi script write to crontab by moritz (Cardinal) on May 13, 2008 at 22:51 UTC
One possible reason is that one of the directories that the file is in doesn't allow the web server to access the file (for example if /home/jma is 750 the story ends here). Another is Security-Enhanced Linux which assigns a "context" to each process, and Apache has the "www" context. It can't access files that don't have that context, and `/home/` doesn't. Selinux is enabled by default on Red Hat distributions and those that are based on it (like CentOS).	[reply] [d/l]
Re^4: cgi script write to crontab by Niner710 (Sexton) on May 14, 2008 at 00:55 UTC
Re^5: cgi script write to crontab by Niner710 (Sexton) on May 14, 2008 at 03:28 UTC
Re^4: cgi script write to crontab by Niner710 (Sexton) on May 14, 2008 at 15:58 UTC
Re: cgi script will not write to crontab by ikegami (Patriarch) on May 13, 2008 at 21:13 UTC
What's the error? (Did the `open` return false, and if so what was in `$!`?) Assuming "Permission denied", As which user is the script running? Who's the owner of /home? What's the permissions of /home? Who's the owner of /home/jma? What's the permissions of /home/jma? Who's the owner of /home/jma/Documents? What's the permissions of /home/jma/Documents? Who's the owner of /home/jma/Documents/cron-job? What's the permissions of /home/jma/Documents/cron-job?	[reply] [d/l] [select]
Re: cgi script will not write to crontab by pc88mxer (Vicar) on May 13, 2008 at 21:08 UTC
For replacing the crontab file, I would use the `crontab` command: `... open(OUT, "\|/usr/bin/crontab -u USER -") or die "open: $!"; print OUT ...new crontab contents...; close(OUT);` [download] See `man 1 crontab` for more details. This ensures that the file is safely replaced and that the `cron` daemon is notified of the change. Unfortunately, you still might have a permissions problem if your web server is not running as USER.	[reply] [d/l] [select]