Security issue with Win2k and Apache

[rethaew]

I posted this in the apache forum also but thought that it is also applicable to the PERL forum.

Good Day. I have recently been put in charge of managing a web server and I am not very familiar with Apache, or web servers in general, so please forgive my ignorance.

The server has Windows2k, Apache 2.2 and Activeperl 5.8. The problem is that there does not seem to be any security with the perl. Any web site that has CGI enabled can run a perl script that will execute system commands, modify files, etc. ANYWHERE on the server, not just in the home directory for that site. This is a gaping security hole that needs to be fixed. So if a user wanted to do some damage, he could in theory delete all other web site folders, destroy some system files, etc. Very bad.

I have searched the web and forums for a solution but this major issues doesn't seem to be addressed much. Can anyone advise on how to limit CGI activity to a web site's home directy with this setup.

Thanks.

Tim

[perl_diver]

use suexec wrapper (su means switch user):

[apache-server.com...]

I have personally never had to set it up but maybe another user here knows the drill. The above should explain though. Not sure if it's applicable to all veersion of Apache though.

[mikesmith76]

I think your problem is that Apache by default on windows runs as a user that has access to most files. You can get apache to run under a different user account

This should get you started

[httpd.apache.org...]

[texmex]

I don't quite follow the problem here. Before perl can execute a script, the script has to exist. Surely you create the scripts and put them onto your own server. Since you write the scripts, you decide what they do. If you don't want your script to do something, you just avoid writing a script that does it.

Are you saying that someone can create a perl script on thier own server, and then coerce your server to execute it?

Restricting perl activity to just the webroot (and it's subdirectories) would be a totally counter productive measure. There are plenty of examples of data that you'd like to keep away from your users DIRECT access (such as databse files, password files etc..). If these files were forced into the publicly accessible area, this would be an even greater security issue.

[edited by: texmex at 3:36 pm (utc) on June 19, 2006]

[rethaew]

no, this server has multiple web site hosting accounts and I am trying to avoid one user's rogue script from deleting all the other users files.

[texmex]

Ah, then you have a problem :-)

[rethaew]

I wish they would implement a workable suexec for win32.