there is IMHO a serious security leak in the ncsa httpd.
We run httpd from inetd and I always thought (but never checked)
that User and Group (from the conf oder httpd.h files) applies
in that case, too.
This is NOT true! (and should be stated clearly in the conf files
IMHO).
You could now argue to use the "user" entry in the inetd.conf file,
BUT:
- I can't set the gid there
- some older systems don't support this (yet)
Rob, could you please add the code from the standalon section to
the inetd section?!
This all doesn't solve a more serious problem with the <INC>
instruction!
Having user-directories configured, any user is able to execute ANY
command out of this document, and this command is run under
server privileges.
This should IMHO be changed to only allow starting of programs
out of .../cgi-bin/ for example.
\Maex
--
______________________________________________________________________________
Markus Stumpf [email protected]
http://www.informatik.tu-muenchen.de/~stumpf/