Web Hosting Talk







View Full Version : ownership problems


clocker1996
03-03-2002, 08:13 PM
Say, i have berk.com
berk.com is setup on the system as: /home/sites/berk.com/public_html

/home/sites/berk.com is owned by the username berk and group berk

username berk's home dir is /home/sites/berk.com

CGI BIN is /home/sites/berk.com/public_html/cgi-bin
/home/sites/berk.com/cgi-bin is owned by berk.berk

so i have say. a script, a cgi script, or few
They are placed in /home/sites/berk.com/public_html/script

(www.berk.com/script)

ok, so, when you goto www.berk.com/script
it loads index.html, which loads the cgi scripts
when the cgi loads, it will ask for the username, and password, and your name!
SO you type all that in, so if you type in say...

like this: www.drirc.net/ac.gif

see that? So, if i were to type in the username node

then what it does is it makes a DIRECTORY called
/home/sites/berk.com/public_html/script/node

however /home/sites/berk.com/public_html/script is owned by berk and grouped by berk

So, the apache webserver runs as the username nobody
group nobody

So when you enter node, it DOESNT create the directory.. i wondered why, then i figured it out. the webserver runs as the username nobody, therfor the username nobody cannot go creating dirs in other peoples dirs which are owned by other users

so, then what i did was:

cd /home/sites/berk.com/public_html/
chown -R nobody.nobody script/

then re-tried the cgi script, and it did create the dir node this time
neat, great.... but are there any other ways i can do this?

I really need it so when you visit www.berk.com/script
and type in a username, i really need it so when you type in say, the username joe
it will create a dir called /home/sites/berk.com/public_html/script/joe

and /home/sites/berk.com/public_html/script/joe WILL BE owned by the username berk and group berk

Does anyone know what i can do?

Tim Greer
03-03-2002, 10:34 PM
You have three choices;

#1: Deal with it like it is now by using root to set the ownership to "nobody".

#2: Set the ownership back to the username and set the 'script' directory to 777 to allow world readable/writable permissions so nobody can create a file or directory within it. It might be better to use option #1 if you do this, since at least that limits only the nobody user (and not every other user on the system -- if that's a concern) to be able to read, write/create/delete files (also depending on other things like permissions, sticky bits and file attributes can help for either solution).

#3: Your best solution is to use a CGI wrapper. There's a few different one's you can use. SuEXEC is the best option though. This will run the script as the user's own UID/GID (user and group) and therefore have permission, plus allow you to set lower permissions on the directory, the file it creates, as well as the actual file that'll be executed.

Remember, that if this creates a file or directory, you should be careful that it can't overwrite or destroy other file or directory info -- and this is a concern even if it's ran as nobody, if other user's have nobody owned files or directories, or world writable permissions (be it running as nobody or the actual user's UID/GID).

priyadi
03-03-2002, 10:37 PM
Long question, short answer: use suexec to run cgi scripts with user privileges.