Re: 'nobody' using sudo -- scary!

On 2008-06-26 17:40, Johnny <schafer.dave@xxxxxxxxx> wrote:
Thanks for the comments. My post wasn't as clear as it should have
been. I was trying avoid irrelevant details (but failed). The more
complete story is that I've taken over for a consultant that built a
perl based website. All users supply a username and password.
There's a page that allows users to edit their vacation message and
toggle their away/back status. That part is broken because of the
permissions issue. Currently the code attempts to set the away
message by:

system "/usr/bin/vacation -i";
system "cp -p /home/$remoteuser/vacation.forward /home/$remoteuser/
\.forward";

To get something perl-specific into that thread: Don't construct command
lines from untrusted user input. Even if you are sure that $remoteuser
can only be an existing user name that cannot contain any funny
characters (like " ", "/" or "."), get into the habit of using the list
form of system:

system "/usr/bin/vacation", "-i";
system "cp", "-p", "/home/$remoteuser/vacation.forward", "/home/$remoteuser/.forward";

(what was the \ for, BTW?)



or to turn off the vacation message:
system "/usr/bin/vacation -i";
system "rm /home/$remoteuser/\.forward";

I haven't done web development before and made the assumption that I'd
have many more cases where 'nobody' wouldn't be sufficient.

First, don't run your webserver as "nobody". Create a specific user and
run it as that user. You may think that it doesn't make any difference
whether the server runs as "nobody" or as "foo". But if your webserver
runs as "nobody" out of the box, chances are that there is some other
stuff on the box also running as nobody, and you don't want to open a
path to privileged commands to that other stuff.

If this web server is tightly controlled and only used for controlling
user accounts, you can now give the user "foo" permission to remove
..forward files, for example using sudo. But don't just give it
permission to run "rm". Instead create a script "vacation-off", and give
it permission to run that script. So even if your server is cracked,
the attacker cannot delete any file. He can only turn off (and on)
vacation messages. (And I don't know if that is possible with sudo, but
you should strongly consider restricting these commands to run as some
"real" user, but not as root).

If your web server is also used for other stuff which is less security
sensitive (and where the web authors are probably less careful), it's a
good idea to put in another layer. Create yet another user and run only
those scripts which need special privileges as that user. You can do
this for example with suexec (with apache) or fastcgi (just about any
webserver). FastCGI is especially nice because it communicates with the
webserver over a socket - the script can run even run on a different
host than the webserver.

hp
.

Relevant Pages

  • RE: website inside or outside the domain?
    ... it is better not to have domain authentication traffic ... publicly accessible web server in a DMZ, with a DC also in the DMZ ... > webserver is ... network) its not the best model to use. ...
    (Focus-Microsoft)
  • Re: design issue - embedded webserver application
    ... A webserver should run on the SBC so that the system can be configured ... using some scripts embedded in html which the webserver then parses ... or suggestions about which technologies to use (cgi for interface? ... trivial learning curve if you don't know what a web server really does ...
    (comp.arch.embedded)
  • Re: PHP Runs In WinXP Command Window But Not In Browser
    ... A surfer users their web browser to send a request to a webserver at ... php script processor back to the web browser. ... You need to check that your web server is working. ...
    (comp.lang.php)
  • backup operation: back up the files belong to www-run
    ... I need to decide how to back up my web server from my office. ... then the script cannot read the files web visitors uploaded (permission ... I try to let my backup script connect to the webserver as root. ...
    (comp.os.linux.security)
  • User directory security
    ... There is a security issue between Unix system and Apache web server. ... An apache server (running as 'nobody') provides user directories, ...
    (comp.unix.admin)