Subject: Re: Setting up co-existing ftp/http

From: Randal Schwartz <[email-masked]>
Date: 01 May 1998 04:42:48 -0700

>>>>> "Timothy" == Timothy J Luoma <luomat+Lists/[email-masked]> writes:

Timothy> Say I wanted to setup a joint http and ftp archive (ie one which could be  
Timothy> accessed by either ftp or http and get at the same files, using apache and  
Timothy> wu-ftp).

Timothy> 1) anything to be aware of as far as security, unexpected 'gotchas', etc?

If they can upload files, you *must* make sure that "AllowOverride",
"Symlinks", "Exec" and "ExecCGI" are all disabled within any area to
which they can write.  Especially if they have a non-chrooted upload,
that means the entire filesystem basically.  What you want to prevent
is an upload of a shellscript that can get triggered by either an SSI
or CGI.

And that's just the first thing that comes to mind.  I'd say this
smells dangerous, but I may just be overly paranoid (from past
experience, I'd say I'm not :-).

-- 
Name: Randal L. Schwartz / Stonehenge Consulting Services (503)777-0095
Keywords: Perl training, UNIX[tm] consulting, video production, skiing, flying
Email: <[email-masked]> Snail: (Call) PGP-Key: (finger [email-masked])
Web: <A HREF="http://www.stonehenge.com/merlyn/">My Home Page!</A>
Quote: "I'm telling you, if I could have five lines in my .sig, I would!" -- me

---

From: Marc Slemko <[email-masked]>
Date: Fri, 1 May 1998 10:50:35 -0600 (MDT)

> is an upload of a shellscript that can get triggered by either an SSI

Take that one step further and use an AllowOverride none so it won't even
try reading htaccess files unless you really need to let some features be
set using htaccess files.