users and security ibwebadmin
Hello,
I am packaging ibwebadmin, a web administration tool for firebird
and interbase databases.
I ran into a problem with users and groups and wonder how to resolve it.
The program runs some tools from the firebird packages (eg gbak, isql etc.)
These tools work locally on database files. All the database related files
are owned by the firebird user and group.
The firebird tools run as the www-data user as they are invoked from the
apache process.
Adding www-data to the firebird groups seems a security risk for the database
when it would be hit by a worm. New databases would still be created as the
www-data users instead of the firebird user.
Must I do something with suid? Make the firebird tools suid firebird? I am not
experienced with ins and outs of suid but I understand they are often a source
of security hazards.
How could I set it up secure so ibwebadmin is still able to process the database
files?
If this questions are not basic and more appropriate for debian-security tell me
and I'll take them there.
I have been playing around with the firebird packages and have a version with some
minor bugs fixes sitting on my harddrive. If it needs a firebird fix I could do
that. (It's orphaned)
Cheers,
Remco.
Reply to: