UNIX for Dummies Questions & Answers

How much do chmod settings affect cgi scripts?? I have a "webmaster" at my work that says I cannot change the permissions on the cgi scripts, and that they work with only certain permissions.

They are set for 644, I want to change them to 775 and put her in her own group, like she should be, not with roo access.

Anybody help me? Thanks!!

I have cgi scripts with 755 - under different owners/groups.

If I change one to 644, it does not work since it is no longer executable. User nobody should be the uid for anyone hitting the web page/executing the cgi script. That is why 755 is needed. You could change it to 645 and it would work.

Are you confusing chmod with chown/chgrp? You mention putting her in a different group with no root access?

The server was not orginally setup correctly. She should be in a group, special privilage group or some other, and have her log in thru her user name and not the root user.

We are a very small company, less than 50 full-time, and have recently had an email sceurity issue.

The server needs to be setup correctly, and she is giving me every excuse not to change anything on the webserver, i.e. if i change the permissions for the cgi scripts to 775, so that she can access the from a group, she would have to re-write the scripts to fix the permissions change.

Everything that I have read thus far and been told, says that that is pig swallow. I'm just trying to find out. I don't want to change the permissions and the websites (VPS) go down.

I hope I've made myself clear, and I thank you for your understanding and quick response!

Yes, that is exactly right - even if she has root access, she should be going in under her own account and doing a su to root or you should get sudo on the system to control what she can do.

Get everything in writing (email) and then find a source that shows she is wrong (your source should be your hardware/software vendor or more than one source (faq, mailing lists) that show the same type of answer).

What httpd are you running? What OS and version?

Apache v1.1

FreBSD 4.4-Release (Server)

I have not been able to find anything that would prove her wrong; but, I have not found anything, or anyone that will confirm what she says is correct.

Thnx

You first need to upgrade your Apache version - 1.3 came out in 1998 and 1.1 is not even mentioned in the quick search I did.

Start reading up on security on the Apache site. See this for a good start. Get a test server (can be your workstation) and run it to find holes in your current configuration.

This all started (from what you wrote) with email security issues. Sounds like you have issues with security in everything. Start searching the web for security relating to the products you are running. You have some reading to do.

A cgi doesn't have to have some absurdly dangerous umask in order to work. It follows the same rules as any other UNIX binary. For users that maintain websites, I will typically let the owner own his own files and use extended ACLS(s) for the web server and other users. See the man pages for getfacl and setfacl.

Here's an example of a cgi/permissions:

-rwx------+ 1 kduffin sysops 7255 Dec 2 19:24 some.cgi

Looking at the extended acl with getfacl (getfacl some.cgi):

# file: some.cgi
# owner: kduffin
# group: sysops
user::rwx
user:nobody:r-x #effective:r-x
group::--- #effective:---
mask:r-x
other:---

Cheers,

Keith