Re: enabling suexec with debian apache [solved]
Robert Varga wrote:
> If there is an exploitable cgi, then there is web access to all of the
> owning user's files. If it is not run via the suEXEC mechanism, then the
> permissions are that of www-data, which are close to nothing.
Without using suexec or cgiwrap, how do you keep each user's cgis from
mucking about with the other user's cgi datafiles? And I certainly
don't want one of my student users' cgis able to mess with my log files,
which are also owned by www-data
> If suEXEC is enabled, then a lot more requirements need to be met for
> running a cgi. This usually leads to a lot of users complaining about this
> and that is not working and why, when it runs on another similar machine?
This is a good thing, IMO. Once students realize that it's their files
and quota that are going to be eaten up by runaway cgis, in my
experience they start paying more attention to what they're writing.
jpb
--
Joe Block <jpb@creol.ucf.edu>
CREOL System Administrator
Social graces are the packet headers of everyday life.
Reply to: