[Xitami] security question about Xitami & CGI's

[Marc Doigny]

Hello !

Any cgi program has the same right as the webserver.
Under windows nt5, you can create a specific user with limited rights and 
run the webserver as this user.

First create a new user with the correct access rights, then change the 
Xitami rights to that of the user (start/programs/administrative 
tools/services, and locate Xitami somewhere at the end of the list, right 
click on the log on as and change to the new user)

You should not allow other people to run cgi programs, unless you secure 
your server.
It's never a good idea to let others upload programs to the cgi directory. 
It will always be a security risk.

marc




At 17:26 15/10/04, you wrote:

>Please take a look at the CGI result below.
>This would indicate that anyone who has a virtual hosted web site on this 
>drive can read and write to any file on the drive.
>Is there any way to allow CGI's but to block read and write permissions to 
>all directories except a specific one in the specified users directory 
>list in order to secure the data somehow?
>Any ideas highly appreciated.


--::Mailserver Verfaillie Bauwens::-- contact [postmaster@verfaillie.com]
Alle mails gecontroleerd op virussen. Virusdefinities dagelijks aangepast.
http://www.verfaillie.com