Sponsored Content
Full Discussion: Web hosting security
Special Forums Cybersecurity Web hosting security Post 302085144 by Sergiu-IT on Tuesday 15th of August 2006 11:55:36 AM
Old 08-15-2006
Hi !
I guess that you didn't understood what I mean (and my english sucks, I know). I'll try to explain the situation again with an example, in this way maybe you (and whoever reads this post) can understand batter what I need.

So, there is the server that is used for web hosting. The web server (apache) is running as nobody. There are a few accounts on the server and each account have a public_html directory where his web page is kept. The home directory of each user must have at least execute rights for the group for apache (nobody) to be able to read the content of public_html directory (or pass through it).
In the public_html directory the user can put his PHP files which are interpreted by apache (nobody). As long as every file in public_html must be readable by nobody and every directory in public_html must have the execute rights some bad user can make a script that will read other users files beacause his script will run as nobody (like all the PHP/CGI scripts).
So, for example, if I make an account on the server I can make a script that will read the /home/some_user/public_html/phpmyadmin/config.php file beacause my script will run as nobody and nobody (as a user) can read all files in public_html directory of each user.
What I want to know is how can I block users to see each others files through some scripts even if the scripts are running as nobody (beacause are interpreted by apache) and 'nobody' has read and/or execute rights on the other user's files ?
Am I clear this time ? If not I'm sorry... I haven't used my english for a while and now I tend to have gramar problems Smilie

Thanks for your time.
 

3 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Web page hosting

I built my website based on Dreamweaver, on Windows platform. My server uses Unix, and the page doesn't look too good. Is there any way to solve this problem without too much of a headache? (1 Reply)
Discussion started by: PCL
1 Replies

2. Cybersecurity

Web hosting security question

Hi, Recently my has been hacked. A .pl script has been uploaded in the root of the directory, which uploaded lot of unwanted files and changed their file permission to 777. I have no clue how did they upload that .pl file in my hosting. Website is in shared hosting. Could they access my web... (3 Replies)
Discussion started by: agriz
3 Replies

3. Shell Programming and Scripting

Ldap connection after hosting on Web Server

Hi.. I have very limited knowledge on LDAP and its configuration and but I have been trying to figure out one issue that takes place when I am running the program that is written in php, but so far its unsuccessful. The server, I am working on is ldap server, which is running on Apache. After... (1 Reply)
Discussion started by: GomathiUoM
1 Replies
nfssec(5)																 nfssec(5)

NAME
nfssec - overview of NFS security modes The mount_nfs(1M) and share_nfs(1M) commands each provide a way to specify the security mode to be used on an NFS file system through the sec=mode option. mode can be sys, dh, krb5, krb5i, krb5p, or none. These security modes can also be added to the automount maps. Note that mount_nfs(1M) and automount(1M) do not support sec=none at this time. mount_nfs(1M) allows you to specify a single security mode; share_nfs(1M) allows you to specify multiple modes (or none). With multiple modes, an NFS client can choose any of the modes in the list. The sec=mode option on the share_nfs(1M) command line establishes the security mode of NFS servers. If the NFS connection uses the NFS Ver- sion 3 protocol, the NFS clients must query the server for the appropriate mode to use. If the NFS connection uses the NFS Version 2 proto- col, then the NFS client uses the default security mode, which is currently sys. NFS clients may force the use of a specific security mode by specifying the sec=mode option on the command line. However, if the file system on the server is not shared with that security mode, the client may be denied access. If the NFS client wants to authenticate the NFS server using a particular (stronger) security mode, the client wants to specify the secu- rity mode to be used, even if the connection uses the NFS Version 3 protocol. This guarantees that an attacker masquerading as the server does not compromise the client. The NFS security modes are described below. Of these, the krb5, krb5i, krb5p modes use the Kerberos V5 protocol for authenticating and pro- tecting the shared filesystems. Before these can be used, the system must be configured to be part of a Kerberos realm. See SEAM(5). sys Use AUTH_SYS authentication. The user's UNIX user-id and group-ids are passed in the clear on the network, unauthenticated by the NFS server. This is the simplest security method and requires no additional administration. It is the default used by Solaris NFS Version 2 clients and Solaris NFS servers. dh Use a Diffie-Hellman public key system (AUTH_DES, which is referred to as AUTH_DH in the forthcoming Internet RFC). krb5 Use Kerberos V5 protocol to authenticate users before granting access to the shared filesystem. krb5i Use Kerberos V5 authentication with integrity checking (checksums) to verify that the data has not been tampered with. krb5p User Kerberos V5 authentication, integrity checksums, and privacy protection (encryption) on the shared filesystem. This provides the most secure filesystem sharing, as all traffic is encrypted. It should be noted that performance might suffer on some systems when using krb5p, depending on the computational intensity of the encryption algorithm and the amount of data being transferred. none Use null authentication (AUTH_NONE). NFS clients using AUTH_NONE have no identity and are mapped to the anonymous user nobody by NFS servers. A client using a security mode other than the one with which a Solaris NFS server shares the file system has its security mode mapped to AUTH_NONE. In this case, if the file system is shared with sec=none, users from the client are mapped to the anonymous user. The NFS security mode none is supported by share_nfs(1M), but not by mount_nfs(1M) or automount(1M). /etc/nfssec.conf NFS security service configuration file See attributes(5) for descriptions of the following attributes: +-----------------------------+-----------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | |Availability |SUNWnfscr | +-----------------------------+-----------------------------+ automount(1M), mount_nfs(1M), share_nfs(1M), rpc_clnt_auth(3NSL), secure_rpc(3NSL), nfssec.conf(4), attributes(5) /etc/nfssec.conf lists the NFS security services. Do not edit this file. It is not intended to be user-configurable. 13 Apr 2005 nfssec(5)
All times are GMT -4. The time now is 04:23 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy