Rev cgi install + potential problem with cgi tutorial
jbv.silences at Club-Internet.fr
Fri May 7 03:18:17 CDT 2004
> > One could do dumb things like put in a "do" statement that executes
> > incomming CGI params. But that would be dumb.
> > Moreover, if the Linux admin does his job right the worst that could
> > happens is that you'll hose your own account setup but everything else
> > on the machine would be fine.
> Right. The tutorial warns against using "do" and "send" this way. But it
> seems to me that this kind of script could run and get you into trouble
> no matter where the engine or the scripts were located, or what their
> permissions were (provided they had the minimum permissions to run at all.)
> I can't think of any way to abuse or hack the engine remotely. But I
> really do want to know if putting the Rev engine in the cgi folder
> causes a "hole" in Apache. I can't think how it would, but I'm no Linux
> guru either.
Although I don't remember every little detail of the installation we did, I'll
try to elaborate on a couple of issues...
One should take 2 things into consideration :
- the risk of having a hacker take the control of the Rev engine and harm
your server is very slim (almost non existent actually), unless your domain
name is ebay or paypal...
- OTOH the risk for a hacker to be able to hijack your server and use it
to harm other servers is increased by installing an executable and its scripts
in the SAME folder, like the cgi-bin. According to what I've been told, that's
how it can cause a security hole in Apache, and for most server admins it's
always a big NO-NO.
If you are only running your own experiments on your own server, you might
decide to take the risk. But when you install Rev cgi on the server of one of
clients for a commercial project (which is what I'm doing now), you really
want to take that risk.
As for our installation :
- the Rev engine has been installed in /usr/local/bin/ with several
and group settings, so that the installation can only be modified via a ssh
and not with a ftp client
- the scripts are in the cgi-bin, and can be uploaded via ftp
- when the engine needs to create / delete files & folders, it can be done
in a special directory in the html account, and the privileges have been set
creating & deleting files & folders can be done via script only.
Again I don't want to scare anyone. The online cgi tutorial is great and we
thank Jacqueline for writing it. Furthermore Rev cgi is a great tool, and I've
it myself for some critical webapps, like locating in realtime on a map cars
desert via GPS data.
But security should be kept in mind when installing it on a server. The Linux
who helped me said that most skilled ISPs would pull their hair when reading
installation chapter of the tutorial. That's why I have the feeling that
security issues in that chapter might help any of us when trying to convince
ISP to install Rev cgi on a server...
More information about the use-livecode