Subject: [LON-CAPA-dev] www owned files

From: Martin Siegert <[email-masked]>
Date: Sat, 5 Oct 2002 13:44:24 -0700

Hi,

I just ran 

# find . -user www -print | grep -v '/proc' > /tmp/www-owned

on our lon-capa library server and ended up with a huge list of files.
This actually worries me: www is the username under which the web server
runs (RH7.3) - it shouldn't own anything (or close to nothing), because in
case of a compromise of the web server (see apache/mod_ssl worm) 
the attacker has access to the www owned files. If there aren't any,
the attacker can't do much.

Under lon-capa www owns files under the following directory trees:

/var/lib/texmf/pk
this ought to be ok: these are fonts created by makefont on the fly.

/home/www
this is what www must own.

/home/httpd/cgi-bin
this scares me. These files should not be owned by www. They only have to
be readable by www. I am very tempted to run 
# chown -R root:root /home/httpd/cgi-bin
Would this break anything?

/home/httpd/html (particularly the adm, res directories)
same thing as cgi-bin. scary. solution: chown to root. objections?
the res directory probably should be owned by some group that creates
resources, i.e., neither root nor www.

/home/httpd/html/lon-status
probably must be owned by www. It writes into this tree.

/home/httpd/lib
should be owned by root.

/home/httpd/lonIDs
probably must be owned by www. correct?

/home/httpd/lonUsers
seems to be the heart of lon-capa. must be owned by www. correct?

/home/httpd/perl, /home/httpd/perl/{lonc,lond,lonsql,searchcat.pl,cleanup_database.pl}
why are these owned by www?

/home/httpd/perl/{logs,tmp}
both probably must be owned by www

/home/httpd/{sockets,prtspool}
these probably need to be owned by www.

/home/<username>/public_html
why are these owned by www? They shouldn't, correct?

Cheers,
Martin

========================================================================
Martin Siegert
Academic Computing Services                        phone: (604) 291-4691
Simon Fraser University                            fax:   (604) 291-4242
Burnaby, British Columbia                          email: [email-masked]
Canada  V5A 1S6
========================================================================

---

From: Scott Harrison <[email-masked]>
Date: Sun, 6 Oct 2002 13:09:15 -0400

Hi Martin:

You are right.

Historically though...
if you look inside doc/loncapafiles/loncapafiles.lpml, you will
see two sets of file ownership/permissions: development and runtime.

"runtime" obeys in spirit what you are suggesting.

"development" was implemented for developers (other than myself) who wanted to
freely alter everything on the system as "www".  (I disagree
with this style of development; it is a lazy solution.)

I will try and move the default tarball-based installation to
the runtime mode this week.  Which should be easy... if you look inside
the Makefile you will see the "CATEGORY" option which is currently
set to "development".

Regards,
Scott

> _______________________________________________
> LON-CAPA-dev mailing list
> [email-masked]
> http://mail.lon-capa.org/mailman/listinfo/lon-capa-dev
> ------( NOTE )------------->
> This E-mail was scanned for viruses by Ramcell Online (http://www.ramcell.net/antivirus.asp)
> 

-- 
Scott Harrison, [email-masked]

---

From: Martin Siegert <[email-masked]>
Date: Mon, 7 Oct 2002 18:39:48 -0700

Hi Scott,

I guess I am argueing with the wrong person ..., but anyway:

If they want to freely alter everything, that still may be ok, if they
had chosen an account other than www. This used to be the "nobody" account
because nobody was supposed to use it other than the web server.
Thus, why not create a "loncapa" account and chown everything to loncapa?
That would keep me happy ... and would be way more secure.
Choosing www is just the worst of all choices ... and a recipe for
desaster.

Cheers,
Martin

---

From: Guy Albertelli II <[email-masked]>
Date: Tue, 8 Oct 2002 15:29:41 -0400 (EDT)

Hi Martin,

I agree with the rest, but I disagree with the ones below.

Let me know where I am wrong.

> resources, i.e., neither root nor www.

But the webserver does the creation/maintenace of these files?

> probably must be owned by www. correct?

Yep.

> seems to be the heart of lon-capa. must be owned by www. correct?

All user data is stored here, read/written to by lond, if we wanted to
seperate the webserver form lond we could modify this ownership.

(Of course rectly we started storing files in here to that the
webserver reads/writes, in a subdirectory under the user account)

> both probably must be owned by www

Web server writes into most of these as do lonc/lond

> these probably need to be owned by www.

Yep. And lond/c write here

> why are these owned by www? They shouldn't, correct?

Depends.

If the user is Unix authenticated then nope, should be owned by the
user.

If the user is internally or kerberos or localauth authentication then
yes since the webserver will be creating/modifying all of these files.

-- 
[email-masked]          BM: n^20 t20 z20 qS 
Guy Albertelli -7-7-9-  O-
    Well I best be going . . . crack don't smoke itself you know 
                                           -C.Chambers