topic Apache System User Authentication in Operating System - Linux

Apache System User Authentication

Rad Rioveros — Wed, 07 Jul 2004 02:38:35 GMT

Hi all,

I have a script, cgi, that will be run only by root user (744). So how will i configure apache so that apache can tell the server where the script will be run that the user running it is "root"?

Thanks in advance!

rad

Re: Apache System User Authentication

Steven E. Protter — Wed, 07 Jul 2004 10:06:02 GMT

Generally, when apache runs a cgi script its run as the default user for the httpd server, set in httpd.conf

in general with depot releases of apache thats the www user.

If you try and run a script thats permissions are 744 under those circumstances you will get an error 500 which will indicate the script is malformed and can not run.

Its usually not a terribly good idea for security purposes to run root permission only scripts through the httpd server. If the server is in a secure chroot jail, you probably can not do it at all.

I would imagine you could configure httpd.conf to run as root user, but that is an immense security openning, and there are already quite a few gotcha's in apache.

I know this does not solve the problem, and in my early security free days i considered setting up a web interface to allow operations to run root scripts.

What i ended up doing was giving them access to the crontab file from the web with authentication and configuring the system to read that file on a daily basis and make it the crontab. That was fraught with problems and was eventually abandoned.

SEP

Re: Apache System User Authentication

Tijl Dullers_4 — Sun, 11 Jul 2004 15:48:36 GMT

If the script is really required to run as root
although it might be a security issue.

You can do a chmod u+s on the script. Change owner to root and give read and execute permission to the group under which the webserver runs.
The group os the script needs to be set to the group the webserver runs under.

Make sure to protect the cgi with authentication and is however possible make sure only a designated set of IP adresses can access the CGI.