Date: Tue, 20 Oct 1998 18:26:01 +0800 (WST) From: Dean Hollister <dean@odyssey.apana.org.au> To: Jason McKay <jasonm@webace.com.au> Cc: questions@FreeBSD.ORG Subject: Re: CGI Security Questions Message-ID: <Pine.BSF.4.05.9810201824370.26065-100000@odyssey.apana.org.au> In-Reply-To: <2.2.32.19981020101923.00694cb0@webace.com.au>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 20 Oct 1998, Jason McKay wrote: > A couple of our users want their own CGI directory, therefore I have a > couple of quick questions: > > 1. How do specify more than one cgi-bin directory? > 2. I have some worries about security, by default are CGI scripts allowed to > exec root only programs? whats to stop a user from uploading a CGI script > that can do damage to the system? Compile and install suexec. Make sure the binary is in the same directory as the httpd binary and its permissions are set correctly (suid). suexec will allow users to run .cgi programs in their native web pages. But the important factor is that such programs/scripts run as the *user* and not root or any other administrative user. Regards, d. +-------------------------------------------------------+ | Dean Hollister, | dean@mushka.ml.org | | Perth, Western Australia. | dean@wa.apana.org.au | +-------------------------------------------------------+ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.05.9810201824370.26065-100000>