Re: Apache: limiting the execution place

["Tim Greer" <chatmaster () charter net>]

From: "exon" <exon () home se>
To: <security-basics () securityfocus com>
Sent: Wednesday, June 18, 2003 6:57 AM
Subject: Re: Apache: limiting the execution place


> No misunderstanding from you, but sort of one for me. Sorry about that.
>
> Still though, I can't quite see the reason for hindering other users to
> see the script code.

perhaps they worked hard on the programming and don't want people lifting
the code, or they do store passwords, yes. perhaps plain text is a poor
method for a script, but even if encrypted, all someone has to do it use the
same script functions with that encrypted password to perhaps access a
database or interact with the other person's script in a harmful manner.
Assuming perhaps that all scripts run as the global web server user. I think
this is also more about users on a system--people you don't have control
over what they use or the like. Many users on web hosts use free scripts or
scripts that do contain plain text passwords. Files with data they don't
want others to see, but have to be acessible from a CGI or PHP script for
their ecommerce site to work, for example.

> Only local users can read them in 'raw'
> format.

Yes, and I think the OP's question was about how to prevent other local
users (on a web host, for example) from reading other client's files on the
same server.

> Unless ofcourse there are some copyright issues here, or there are
> 'hardcoded' (as hardcoded as they get in scripts) plaintext passwords to
> protect, in which case the scripts are flawed anyways. Passwords should
> be stored encrypted in separate files.

They should be, but if the CGI or PHP script has to read it in, other users
can too, unless some type of method is implemented, such as is being
discussed in this topic.
--
Regards,
Tim Greer  chatmaster () charter net
Server administration, security, programming, consulting.


---------------------------------------------------------------------------
Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts!
The Gartner Group just put Neoteris in the top of its Magic Quadrant,
while InStat has confirmed Neoteris as the leader in marketshare.
     
Find out why, and see how you can get plug-n-play secure remote access in
about an hour, with no client, server changes, or ongoing maintenance.
          
Visit us at: http://www.neoteris.com/promos/sf-6-9.htm
----------------------------------------------------------------------------