www.delorie.com/gnu/docs/cfengine/cfengine-Tutorial_94.html

search

	Buy GNU books!

GNU cfengine

7.17 WWW security

The security of the web is a slightly paradoxical business. On the one hand, we make a system for distributing files to anyone without the need for passwords, and on the other hand we are interested in limited who gets what information and who can change what. If you want web privacy you have to exclude the possibility of running untrusted CGI scripts, i.e. CGI programs which you did not write yourself since CGI programs can circumvent any server security. This is because of a fundamental weakness in the way that a WWW server works. It makes user-CGI scripts incompatible with the idea of private WWW areas.

The problem with CGI is this: in order for the httpd daemon to be able to read information to publish it, that information must be readable by the UID with which httpd runs (e.g. the www special user (you should not run with uid nobody since that can be mixed up with NFS mappings)). But CGI programs automatically run with this www UID also. Since it is not possible to restrict the actions of CGI programs which you did not write yourself, any CGI program has automatically normal file permission access to any file which the server can see. A CGI program could choose to open a restricted file circumventing the security of the daemon. In short, privacy requires a separate UID (a separate daemon and port number) or a separate server host altogether.

Provided you acknowledge this weakness, you can still use cfengine to administrate the permissions and access files on say two WWW servers from your central location. Let us imagine having a public WWW server and a private WWW server and assume that they have a common user/UID database. We begin by defining a user-ID and group-ID for the public and private services. These need to have different ID's in order to prevent the CGI trick mentioned above.

editfiles: wwwpublic:: { $(publicdocroot)/.htaccess AutoCreate EmptyEntireFilePlease AppendLine "order deny,allow" AppendLine "deny from all" AppendLine "allow from all" } wwwprivate:: { $(privatedocroot)/.htaccess AutoCreate EmptyEntireFilePlease AppendLine "order deny,allow" AppendLine "deny from all" AppendLine "allow .example.org" }

Your documnts should be owned by a user and group which is *not* the same as the UID/GID the daemon runs with, otherwise CGI programs and server-side emebellishments could write and destroy those files. You will also want to ensure that the files are readable by the www daemon, so a files command can be used to this end. You might want a group of people to have access to the files to modifiy their contents.

files: wwwprivate:: $(privatedocroot) mode=664 owner=priv-data group=priv-data act=fixall wwwpublic:: $(publicdocroot) mode=664 owner=public-data group=public-data act=fixall