[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Apache security compromise



On Mon, Jul 08, 2002 at 09:46:24PM +0200, martin f krafft wrote:
| also sprach David Wright <ichbin@shadlen.org> [2002.07.08.2140 +0200]:
| > Unfortunately, any apache update will re-set the suid bit on this 
| > binary, and you'll have to repeat this step afterward.
| 
| You sure about that?  AFAIK, Debian's standard is to turn suexec off.

Yep.  I found that suexec was the reason my cgi scripts wouldn't work,
even though there was nothing wrong with them.  (the "wrong" was
~/public/html instead of ~/public_html)

I renamed my suexec binary to disable it.  When I upgraded apache, it
had reinstated it (well, the new one) and I had to re-disable it to
restore my scripts.
 
-D

-- 
 
Do not pay attention to every word people say, 
    or you may hear your servant cursing you --
for you know in your heart 
    that many times you yourself have cursed others.
        Ecclesiastes 7:21-22
 
http://dman.ddts.net/~dman/

Attachment: pgph3VdVSkQJE.pgp
Description: PGP signature


Reply to: