Bugtraq mailing list archives

By Date

By Thread

Re: HTTPD bug

On Mon, 17 Apr 1995, Baba Z Buehler wrote:

the httpd process will read files with the permissions of the user it is
running as.  if you run your httpd as root, then you've got a problem.

        So it's OK for the rest of the net to read any files a 
non-privileged user can read ?

run httpd as user 'nobody' or some such, and you won't have this problem.

        Except in the scenario Mr Pink described, if they had not had shadow 
passwords but /etc/passwd mode 644 then of course 'nobody' _could_ read 
that, as well as every other file on the system that is world-readable.

        Unfortunately just running as 'nobody' is not enough, you have to 
either disallow the following of symlinks in user directories (which is a 
good idea anyway), choose which users can have symlinks and have a more 
complex access list (this is NCSA httpd, I don't know about the CERN 
version), or lastly just allow any user to give the network read access 
to your system (may be option for those in a secure environment or who 
trust all the users on the system).

        Regards,

                        Martin.


----------------------------------------------------------------
| Martin Hargreaves,                        ch11mh () surrey ac uk|
| Undergraduate Computational Chemist                          |
| WWW Server Admin                 http://www.chem.surrey.ac.uk|
----------------------------------------------------------------

By Date

By Thread

Current thread:

• Re: HTTPD bug Mr Martin J Hargreaves (Apr 16)
  • Re: HTTPD bug Darren Reed (Apr 16)
  • Re: HTTPD bug Baba Z Buehler (Apr 17)
    • Re: HTTPD bug Mr Martin J Hargreaves (Apr 17)
      • Re: HTTPD bug Joe Konczal (Apr 18)
  • Re: HTTPD bug carson () lehman com (Apr 17)
    • Re: HTTPD bug Tom Fitzgerald (Apr 17)