Huge hole in apache webservers..

Greetings everyone,

This is slightly off topic but I wanted some opinions.

Normally, Im a web designer, however, in an ongoing attempt to further
my skills, I decided to take on more ability to do RedHat admin stuff,
so that I can learn the ins and outs, yada, yada, yada..

So, I set up a RH9 linux box on my local network at my office. Enabled
httpd, php, mySQL, sshd, ftpd, and so on. First thing to do is create
some accounts (just like my ISP), and log in with these accounts just
like a client would. I set up a starting index.html pages and tested
them out. First off... each account got the 403 forbidden page? humm..
looked at the permissions, and each account is given only 'rwx' (read,
write, execute) for their directories only.. Ok, if I set the 'rwx'
permissions for world read, wouldn't this open up each users directories
so that anyone can get in, and look around? How are you suppose to set
up directories that the apache httpd can look though, but not the users??

Something seams horribly wrong here?? Since the apache web server is
only given a standard user access (just like another user) than you
have to give your directories standard user read also?? How the heck do
you hide anything, such as databases, php source files, cgi scripts??

To test my theory, I logged into my companies virtual host ISP using
ssh. I was horrified to discover that I could go in and out of hundreds
of virtual web sites simply by going:

/home/some_virutal_site/public_html/

It didn't take me a second before doing a 'vi' on a .php file to simple
look at the mySQL db user/password names.. using these db's couldn't I
just look though these to find credit card info and data??

I don't get it? Am I missing something? How the heck does anyone
expect to run a ecommerce site when it's so insecure?

-Richard

On Fri, 12 Sep 2003 01:21:53 GMT, Richard Ragon <bsema01.DeleteThis@hanaho.com> wrote:
 > Greetings everyone,
 >
 > This is slightly off topic but I wanted some opinions.
 >
 > Normally, Im a web designer, however, in an ongoing attempt to further
 > my skills, I decided to take on more ability to do RedHat admin stuff,
 > so that I can learn the ins and outs, yada, yada, yada..
 >
 > So, I set up a RH9 linux box on my local network at my office. Enabled
 > httpd, php, mySQL, sshd, ftpd, and so on. First thing to do is create
 > some accounts (just like my ISP), and log in with these accounts just
 > like a client would. I set up a starting index.html pages and tested
 > them out. First off... each account got the 403 forbidden page? humm..
 > looked at the permissions, and each account is given only 'rwx' (read,
 > write, execute) for their directories only.. Ok, if I set the 'rwx'
 > permissions for world read, wouldn't this open up each users directories
 > so that anyone can get in, and look around? How are you suppose to set
 > up directories that the apache httpd can look though, but not the users??

You don't. The directories should be at least:

rwx-----x

and files:

rwx---r-x

 > Something seams horribly wrong here?? Since the apache web server is
 > only given a standard user access (just like another user) than you
 > have to give your directories standard user read also?? How the heck do
 > you hide anything, such as databases, php source files, cgi scripts??

You don't. That how shared hosting works.

PHP has a "safe_mode" that restricts its access to the web tree. And
a chroot jail can be used to lock users into their own home directories
when they use ssh. But there is usually a way around such restrictions,
via CGI, for example.

 > To test my theory, I logged into my companies virtual host ISP using
 > ssh. I was horrified to discover that I could go in and out of hundreds
 > of virtual web sites simply by going:
 >
 > /home/some_virutal_site/public_html/
 >
 > It didn't take me a second before doing a 'vi' on a .php file to simple
 > look at the mySQL db user/password names.. using these db's couldn't I
 > just look though these to find credit card info and data??

You would hope not. Such data should not be used with shared hosting
accounts.


 > I don't get it? Am I missing something? How the heck does anyone
 > expect to run a ecommerce site when it's so insecure?

You don't run ecommerce sites on shared hosting setups, for that very reason.

CGI scripts can be setup to execute as the owner which allows them
to be group and world non-readable with the suexec system that Apache uses.
But that can lead to other problems, and CGI scripts can be a bottleneck.

--
Sam Holden<!-- ~MESSAGE_AFTER~ -->