Newsgroups: fj.unix
Path: galaxy.trc.rwcp.or.jp!news.trc!nf2.iij.ad.jp!nr0.iij.ad.jp!news.iij.ad.jp!rim.or.jp!tamaru-news!kuee-news!kuis-news!sakura.kudpc!cancer.nca5.ad.jp!nfeed.gw.nagoya-u.ac.jp!vega2!arisawa
From: arisawa@vega2.aichi-u.ac.jp (Kenji Arisawa)
Subject: Re: cgi security
Sender: news@vega2.aichi-u.ac.jp (News Master)
Message-ID: <Ery4Jr.Ks7@vega2.aichi-u.ac.jp>
Date: Sat, 25 Apr 1998 01:38:14 GMT
References: <ErwptH.30x@vega2.aichi-u.ac.jp>
Nntp-Posting-Host: vega2
Organization: Aichi University Computer Center, Aichi University, Aichi, Japan.
X-Newsreader: mnews [version 1.18PL3+] 1994-08/01(Mon)
Lines: 42
Xref: galaxy.trc.rwcp.or.jp fj.unix:7898
X-originally-archived-at: http://galaxy.rwcp.or.jp/text/cgi-bin/newsarticle2?ng=fj.unix&nb=7898&hd=a
X-reformat-date: Mon, 18 Oct 2004 15:18:22 +0900
X-reformat-comment: Tabs were expanded into 4 column tabstops by the Galaxy's archiver. See http://katsu.watanabe.name/ancientfj/galaxy-format.html for more info.

$BM-_7(B@$B0&CNBg3X$G$9(B

> $B6C$$$?;v$K!"(B
> CGI SECURITY TEST
> ruid=-2 euid=-2
> rgid=0 egid=0
> $B$H$J$C$F$$$^$7$?!#$D$^$j(B wheel $B$N8"8B$G$9!#(B
> httpd.conf $B$NFbMF$O(B
> User nobody
> Group #-1

User nobody
Group #-1
$B$O(B defalut $B$N@_Dj$G$9$,!"KM$N(Bsystem $B$K$O(B -1 $B$N%0%k!<%W$OB8:_$7$J$$!#(B
nogroup $B$O(B -2 $B$G$9!#(B
apache 1.1 $B$G$O!"B8:_$7$J$$(B group $B$,@_Dj$5$l$?;~$K$O(B 0 $B$H$7$F=hM}$9$k(B
$B$N$G$7$g$&$M!#(B
$B$7$+$7$3$l$OHs>o$KBg$-$JLdBj$G$9!#$J$K$7$m(B root $B$N=jB0(B group $B$O(B wheel
$B$G!"(B wheel group $B$O7k9=8"8B$r;}$C$F$$$^$9$+$i$M!#(B
$BKM$N>l9g$K$O$3$NLdBj$,(B ftp $B$X$N%"%?%C%/$HAH$_9g$o$5$l$F$$$^$7$?!#(B

$B$=$l$+$i!"8m2r$,$"$kMM$G$9!#0J2<$N(B3$B$D$NLdBj$O6hJL$7$F2<$5$$!#(B
1. httpd $B$r(B root$B8"8B$G5/F0$9$k;v!#(B(UNIX$B$N>l9g$7$+$?$,$J$$(B)
2. httpd $B$,(B root$B8"8B$GF0$$$F$$$k;v!#(B($B$3$l$O%W%m%0%i%`$NLdBj$G$"$j4m81$G$"$k(B)
3. httpd $B$,(B root$B8"8B$G(Bcgi$B$r5/F0$9$k;v!#(B($B$3$l$O@_Dj$NLdBj$G$O$"$k$,(B
$B%W%m%0%i%`$N%P%0$bMm$s$G$$$k(B)
$BKM$O(B 1 $B$K4X$7$F$O(B root $B$G9T$C$F$*$j!"(B2 $B$O%W%m%0%i%`$rFI$s$G$$$J$$$N$G(B
$B$I$&$J$C$F$$$k$+CN$i$J$$!"(B3 $B$O(B nobody/wheel $B$G(B cgi $B$,<B9T$5$l$F$$$k$H(B
$B8@$C$F$$$k$N$G$9!#(B

$B967b$HKI8f$O%$%?%A$4$C$3$G$9!#KM$O$3$N7kKv$K4X$7$F$OHa4QE*$K9M$($F$$$^$9!#(B
$B967b<T$OG.?4$G$"$k!#%7%9%F%`4IM}<T$N0lIt$OG.?4$G$"$k!#(B
$B$7$+$74IM}<T$NBgB??t$O%P!<%8%g%s%"%C%W$r<!!9$K$d$C$F9T$1$kDx2K$G$O$J$$!#(B
$B4IM}<T$NAX$OBg$-$J?~Ln$r;}$C$F$*$j!"967b<T$NG.?4$5$HG=NO$O4IM}<T$N>e0L(B
$B%/%i%9$KB0$7$F$$$k!#(B
$BKM$O(B root$B8"8B$NLdBj$KF_46$J$N$G$O$J$/!"8=<B$K$O(BUNIX$B%5!<%P$N$*<i$j$K(B
$BBg$-$J;~4V$r3d$1$J$$$@$1$J$N$G$9!#$3$3(B2$BG/4V!"<B:]>e$[$C$?$i$+$7$G$7$?$M!#(B
$BKM$O8xF;$KBg@Z$J$b$N$rCV$+$J$$<g5A$J$N$G5$3Z$K$7$F$$$^$7$?$,!"$3$3$^$G(B
$B$d$i$l$k$HH?>J$7$^$9$M!#(B

$BM-_77r<#(B
E-mail: arisawa@aichi-u.ac.jp
