Re: Http server with authenticated user suexec cgi's

[Evan Webb]

It's risky, but you could run apache as root (or suexec the cgi to root) 
and then within the script itself do a setuid and seteuid. Since apache is 
forking and execing the cgi itself, you should be able to use setuid (the 
same way login and ssh does when a user logs into the system). Within perl 
you just change the $< var iirc. I'd open up the login source and see how 
it uses setuid to change uids when the user logs in, and maybe implement a 
C wrapper that is exec'd as the cgi that setuid's and in turn execs the 
actual script. In summary, sure, it's possible.

Evan Webb

--On Thursday, April 03, 2003 10:54 AM +0200 "I. Forbes" 
<[EMAIL PROTECTED]> wrote:

Hello Dustin

On 2 Apr 2003 at 8:07, Dustin Douglas wrote:

I don't know of anything that does everything that you want, but a
good starting point might be the apache suexec docs. For apache 1.3.x
they can be found at http://httpd.apache.org/docs/suexec.html
Implementing the desired functionality is left as an exercise to the
reader.
Apache suexec will not do this. This runs the cgi scripts with the
uid of the "owner" of the website, where there are many websites with
many "owners" on the same server.
I am looking for a system to run the cgi scripts with the uid of the
authenticated user. Ie, one server, one web site, many system users
each running the cgi's with their own uid.
This is the same security situation as a user logging in via a telnet
prompt and running system utilities like "ls" or "vi". Except I want
the user to login via a web page and run cgi's to make things more
user friendly.
Regards

Ian

---------------------------------------------------------------------
Ian Forbes ZSD
http://www.zsd.co.za
Office: +27 21 683-1388  Fax: +27 21 674-1106
Snail Mail: P.O. Box 46827, Glosderry, 7702, South Africa
---------------------------------------------------------------------


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact
[EMAIL PROTECTED]


Evan Webb // [EMAIL PROTECTED]

--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]