On 06/17/2011 11:12 AM, Robert Cates wrote:
> On 06/17/2011 01:56 PM, Tim wrote:
>> Ed Greshko:
>>>> Depending on the type of web pages you serve you may find there to be a
>>>> buffer overflow vulnerability which gives an attacker a shell and allows
>>>> them to execute arbitrary commands as "apache".
>>>>
>>>> I smell "danger Will Robinson"!
>> Gary Stainburn:
>>> You do have a valid point, but this is a non-public low-risk server used for
>>> internal admin stuff.
>> Though that may lead to complacency, and someone may find a way to cause
>> you problems that you hadn't thought of. You are probably far better
>> finding a way to run your command as some other user, triggered by your
>> risky apache user.
>>
>> Generally, risky users are prevented from being able to run things for
>> good reasons; and you're best not to shred your security blankets for
>> the sake of convenience, now.
>>
>
> Thank you Ed, thank you Tim! I completely agree. Bad/risky practice
> can easily carry over at some point to the danger zone, and I think it's
> especially important to stress this view/point on mailing lists not that
> somebody later will think this is a solution to their problem,
> jeopardizing a productive system.
May I recommend you create some unprivileged user (I use the name
"avatar"), then set up sudo to permit user "apache" to run the "at"
command as user "avatar" without a password? Something like:
avatar ALL = NOPASSWD:/usr/bin/at
Then your PHP script could:
exec("sudo -u innocuoususer at blah-blah");
and the at command would run as "avatar". You could set "apache" back
to /bin/nologin and be quite a bit safer.
----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, C2 Hosting ricks@xxxxxxxx -
- AIM/Skype: therps2 ICQ: 22643734 Yahoo: origrps2 -
- -
- If you can't beat your computer at chess...try kickboxing! -
----------------------------------------------------------------------
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
