From: Erik Abele Date: Sun, 12 Oct 2003 23:37:16 +0000 (+0000) Subject: "Change the list of checks in the security model to more accurately reflect X-Git-Tag: pre_ajp_proxy~1112 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a68c03ca64e7e49ecbc5571b3b4e558b70031086;p=thirdparty%2Fapache%2Fhttpd.git "Change the list of checks in the security model to more accurately reflect what happens, and in the correct order. Also fix the default locations, and add a subsection about setting paranoid permissions." Submitted by: Colm MacCarthaigh Additionally cleaned up the whole xml source to keep the docs consistent (mostly cosmetic fixes, formatting, typos). git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@101431 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/suexec.html.en b/docs/manual/suexec.html.en index 3c1376f391a..04ea0815d62 100644 --- a/docs/manual/suexec.html.en +++ b/docs/manual/suexec.html.en @@ -35,9 +35,9 @@ develop and run private CGI or SSI programs. However, if suEXEC is improperly configured, it can cause any number of problems and possibly create new holes in your computer's security. If - you aren't familiar with managing setuid root programs and the - security issues they present, we highly recommend that you not - consider using suEXEC.

+ you aren't familiar with managing setuid root programs + and the security issues they present, we highly recommend that + you not consider using suEXEC.

  • Before we begin
  • suEXEC Security Model
    • @@ -124,6 +124,16 @@
    1. + Is the user executing this wrapper a valid user of + this system? + +

      + This is to ensure that the user executing the wrapper is + truly a user of the system. +

      +
      2. + +
    2. Was the wrapper called with the proper number of arguments? @@ -137,16 +147,6 @@

      3. -
    3. - Is the user executing this wrapper a valid user of - this system? - -

      - This is to ensure that the user executing the wrapper is - truly a user of the system. -

      -
      4. -
    4. Is this valid user allowed to run the wrapper? @@ -192,8 +192,8 @@

      - Presently, suEXEC does not allow 'root' to execute - CGI/SSI programs. + Presently, suEXEC does not allow root + to execute CGI/SSI programs.

      5. @@ -214,8 +214,8 @@ group?

      - Presently, suEXEC does not allow the 'root' group to - execute CGI/SSI programs. + Presently, suEXEC does not allow the root + group to execute CGI/SSI programs.

      @@ -244,11 +244,12 @@
    5. - Does the directory in which the target CGI/SSI program - resides exist? + Can we change directory to the one in which the target + CGI/SSI program resides?

      - If it doesn't exist, it can't very well contain files. + If it doesn't exist, it can't very well contain files. If we + can't change directory to it, it might aswell not exist.

      6. @@ -363,14 +364,14 @@
      This option enables the suEXEC feature which is never installed or activated by default. At least one - --with-suexec-xxxxx option has to be provided together with the - --enable-suexec option to let APACI accept your request for - using the suEXEC feature.
      + --with-suexec-xxxxx option has to be provided + together with the --enable-suexec option to let + APACI accept your request for using the suEXEC feature.
      --with-suexec-bin=PATH
      -
      The path to the suexec binary must be hard-coded in - the server for security reasons. Use this option to override +
      The path to the suexec binary must be hard-coded + in the server for security reasons. Use this option to override the default path. e.g. --with-suexec-bin=/usr/sbin/suexec
      @@ -402,8 +403,8 @@
      Define as the DocumentRoot set for Apache. This will be the only hierarchy (aside from UserDirs) that can be used for - suEXEC behavior. The default directory is the --datadir value - with the suffix "/htdocs", e.g. if you configure + suEXEC behavior. The default directory is the --datadir + value with the suffix "/htdocs", e.g. if you configure with "--datadir=/home/apache" the directory "/home/apache/htdocs" is used as document root for the suEXEC wrapper.
      @@ -426,7 +427,7 @@ transactions and errors are logged (useful for auditing and debugging purposes). By default the logfile is named "suexec_log" and located in your standard logfile directory - (--logfiledir). + (--logfiledir).
      --with-suexec-safepath=PATH
      @@ -438,15 +439,15 @@

      Checking your suEXEC setup
      Before you compile and install the suEXEC wrapper you can - check the configuration with the --layout option.
      + check the configuration with the --layout option.
      Example output:

      suEXEC setup:
      - suexec binary: /usr/local/apache/sbin/suexec
      - document root: /usr/local/apache/share/htdocs
      + suexec binary: /usr/local/apache2/sbin/suexec
      + document root: /usr/local/apache2/share/htdocs
      userdir suffix: public_html
      - logfile: /usr/local/apache/var/log/suexec_log
      + logfile: /usr/local/apache2/var/log/suexec_log
      safe path: /usr/local/bin:/usr/bin:/bin
      caller ID: www
      minimum user ID: 100
      @@ -456,33 +457,63 @@

      Compiling and installing the suEXEC wrapper
      If you have enabled the suEXEC feature with the - --enable-suexec option the suexec binary (together with Apache - itself) is automatically built if you execute the command - "make".
      + --enable-suexec option the suexec binary + (together with Apache itself) is automatically built if you execute + the make command.
      After all components have been built you can execute the - command "make install" to install them. The binary image - "suexec" is installed in the directory defined by the --sbindir - option. Default location is - "/usr/local/apache/sbin/suexec".
      + command make install to install them. The binary image + suexec is installed in the directory defined by the + --sbindir option. The default location is + "/usr/local/apache2/sbin/suexec".
      Please note that you need root privileges for the installation step. In order for the wrapper to set the user ID, it must be installed as owner root and must have the setuserid execution bit set for file modes.

      +

      Setting paranoid permissions
      + Although the suEXEC wrapper will check to ensure that its + caller is the correct user as specified with the + --with-suexec-caller configure option, there is + always the possibility that a system or library call suEXEC uses + before this check may be exploitable on your system. To counter + this, and because it is best-practise in general, you should use + filesystem permissions to ensure that only the group Apache + runs as may execute suEXEC.

      + +

      If for example, your web-server is configured to run as:

      + +

      + User www
      + Group webgroup
      +

      + +

      and suexec is installed at + "/usr/local/apache2/sbin/suexec", you should run:

      + +

      + chgrp webgroup /usr/local/apache2/bin/suexec
      + chmod 4750 /usr/local/apache2/bin/suexec
      +

      + +

      This will ensure that only the group Apache runs as can even + execute the suEXEC wrapper.

      top

      Enabling & Disabling suEXEC

      Upon startup of Apache, it looks for the file - "suexec" in the "sbin" directory (default is + suexec in the directory defined by the + --sbindir option (default is "/usr/local/apache/sbin/suexec"). If Apache finds a properly configured suEXEC wrapper, it will print the following message to the error log:

      +

      [notice] suEXEC mechanism enabled (wrapper: /path/to/suexec)

      +

      If you don't see this message at server startup, the server is most likely not finding the wrapper program where it expects it, or the executable is not installed setuid root.

      @@ -492,7 +523,7 @@ restart Apache. Restarting it with a simple HUP or USR1 signal will not be enough.

      If you want to disable suEXEC you should kill and restart - Apache after you have removed the "suexec" file.

      + Apache after you have removed the suexec file.

      top

      Using suEXEC

      @@ -520,10 +551,10 @@

      Debugging suEXEC

      The suEXEC wrapper will write log information - to the file defined with the --with-suexec-logfile option as - indicated above. If you feel you have configured and installed - the wrapper properly, have a look at this log and the error_log - for the server to see where you may have gone astray.

      + to the file defined with the --with-suexec-logfile + option as indicated above. If you feel you have configured and + installed the wrapper properly, have a look at this log and the + error_log for the server to see where you may have gone astray.

      top
      @@ -546,7 +577,7 @@ Hierarchy limitations

      - For security and efficiency reasons, all suexec requests + For security and efficiency reasons, all suEXEC requests must remain within either a top-level document root for virtual host requests, or one top-level personal document root for userdir requests. For example, if you have four diff --git a/docs/manual/suexec.xml b/docs/manual/suexec.xml index 8c3b6cdbd9f..653f2fa67fb 100644 --- a/docs/manual/suexec.xml +++ b/docs/manual/suexec.xml @@ -19,9 +19,9 @@ develop and run private CGI or SSI programs. However, if suEXEC is improperly configured, it can cause any number of problems and possibly create new holes in your computer's security. If - you aren't familiar with managing setuid root programs and the - security issues they present, we highly recommend that you not - consider using suEXEC.

      + you aren't familiar with managing setuid root programs + and the security issues they present, we highly recommend that + you not consider using suEXEC.

      Before we begin @@ -96,6 +96,16 @@
      1. + Is the user executing this wrapper a valid user of + this system? + +

        + This is to ensure that the user executing the wrapper is + truly a user of the system. +

        +
        2. + +
      2. Was the wrapper called with the proper number of arguments? @@ -109,16 +119,6 @@

        3. -
      3. - Is the user executing this wrapper a valid user of - this system? - -

        - This is to ensure that the user executing the wrapper is - truly a user of the system. -

        -
        4. -
      4. Is this valid user allowed to run the wrapper? @@ -164,8 +164,8 @@

        - Presently, suEXEC does not allow 'root' to execute - CGI/SSI programs. + Presently, suEXEC does not allow root + to execute CGI/SSI programs.

        5. @@ -186,8 +186,8 @@ group?

        - Presently, suEXEC does not allow the 'root' group to - execute CGI/SSI programs. + Presently, suEXEC does not allow the root + group to execute CGI/SSI programs.

        @@ -216,11 +216,12 @@
      5. - Does the directory in which the target CGI/SSI program - resides exist? + Can we change directory to the one in which the target + CGI/SSI program resides?

        - If it doesn't exist, it can't very well contain files. + If it doesn't exist, it can't very well contain files. If we + can't change directory to it, it might aswell not exist.

        6. @@ -336,14 +337,14 @@
        This option enables the suEXEC feature which is never installed or activated by default. At least one - --with-suexec-xxxxx option has to be provided together with the - --enable-suexec option to let APACI accept your request for - using the suEXEC feature.
        + --with-suexec-xxxxx option has to be provided + together with the --enable-suexec option to let + APACI accept your request for using the suEXEC feature.
        --with-suexec-bin=PATH
        -
        The path to the suexec binary must be hard-coded in - the server for security reasons. Use this option to override +
        The path to the suexec binary must be hard-coded + in the server for security reasons. Use this option to override the default path. e.g. --with-suexec-bin=/usr/sbin/suexec
        @@ -375,8 +376,8 @@
        Define as the DocumentRoot set for Apache. This will be the only hierarchy (aside from UserDirs) that can be used for - suEXEC behavior. The default directory is the --datadir value - with the suffix "/htdocs", e.g. if you configure + suEXEC behavior. The default directory is the --datadir + value with the suffix "/htdocs", e.g. if you configure with "--datadir=/home/apache" the directory "/home/apache/htdocs" is used as document root for the suEXEC wrapper.
        @@ -399,7 +400,7 @@ transactions and errors are logged (useful for auditing and debugging purposes). By default the logfile is named "suexec_log" and located in your standard logfile directory - (--logfiledir). + (--logfiledir).
        --with-suexec-safepath=PATH
        @@ -411,15 +412,15 @@

        Checking your suEXEC setup
        Before you compile and install the suEXEC wrapper you can - check the configuration with the --layout option.
        + check the configuration with the --layout option.
        Example output:

        suEXEC setup:
        - suexec binary: /usr/local/apache/sbin/suexec
        - document root: /usr/local/apache/share/htdocs
        + suexec binary: /usr/local/apache2/sbin/suexec
        + document root: /usr/local/apache2/share/htdocs
        userdir suffix: public_html
        - logfile: /usr/local/apache/var/log/suexec_log
        + logfile: /usr/local/apache2/var/log/suexec_log
        safe path: /usr/local/bin:/usr/bin:/bin
        caller ID: www
        minimum user ID: 100
        @@ -429,33 +430,63 @@

        Compiling and installing the suEXEC wrapper
        If you have enabled the suEXEC feature with the - --enable-suexec option the suexec binary (together with Apache - itself) is automatically built if you execute the command - "make".
        + --enable-suexec option the suexec binary + (together with Apache itself) is automatically built if you execute + the make command.
        After all components have been built you can execute the - command "make install" to install them. The binary image - "suexec" is installed in the directory defined by the --sbindir - option. Default location is - "/usr/local/apache/sbin/suexec".
        + command make install to install them. The binary image + suexec is installed in the directory defined by the + --sbindir option. The default location is + "/usr/local/apache2/sbin/suexec".
        Please note that you need root privileges for the installation step. In order for the wrapper to set the user ID, it must be installed as owner root and must have the setuserid execution bit set for file modes.

        +

        Setting paranoid permissions
        + Although the suEXEC wrapper will check to ensure that its + caller is the correct user as specified with the + --with-suexec-caller configure option, there is + always the possibility that a system or library call suEXEC uses + before this check may be exploitable on your system. To counter + this, and because it is best-practise in general, you should use + filesystem permissions to ensure that only the group Apache + runs as may execute suEXEC.

        + +

        If for example, your web-server is configured to run as:

        + + + User www
        + Group webgroup
        +         + +

        and suexec is installed at + "/usr/local/apache2/sbin/suexec", you should run:

        + + + chgrp webgroup /usr/local/apache2/bin/suexec
        + chmod 4750 /usr/local/apache2/bin/suexec
        +         + +

        This will ensure that only the group Apache runs as can even + execute the suEXEC wrapper.

      Enabling & Disabling suEXEC

      Upon startup of Apache, it looks for the file - "suexec" in the "sbin" directory (default is + suexec in the directory defined by the + --sbindir option (default is "/usr/local/apache/sbin/suexec"). If Apache finds a properly configured suEXEC wrapper, it will print the following message to the error log:

      + [notice] suEXEC mechanism enabled (wrapper: /path/to/suexec) +

      If you don't see this message at server startup, the server is most likely not finding the wrapper program where it expects it, or the executable is not installed setuid root.

      @@ -465,7 +496,7 @@ restart Apache. Restarting it with a simple HUP or USR1 signal will not be enough.

      If you want to disable suEXEC you should kill and restart - Apache after you have removed the "suexec" file.

      + Apache after you have removed the suexec file.

      Using suEXEC @@ -496,10 +527,10 @@
      Debugging suEXEC

      The suEXEC wrapper will write log information - to the file defined with the --with-suexec-logfile option as - indicated above. If you feel you have configured and installed - the wrapper properly, have a look at this log and the error_log - for the server to see where you may have gone astray.

      + to the file defined with the --with-suexec-logfile + option as indicated above. If you feel you have configured and + installed the wrapper properly, have a look at this log and the + error_log for the server to see where you may have gone astray.

      @@ -523,7 +554,7 @@ Hierarchy limitations

      - For security and efficiency reasons, all suexec requests + For security and efficiency reasons, all suEXEC requests must remain within either a top-level document root for virtual host requests, or one top-level personal document root for userdir requests. For example, if you have four