- publishing free software manuals
The Apache HTTP Server Reference Manual
by Apache Software Foundation
Paperback (6"x9"), 862 pages
ISBN 9781906966034
RRP £19.95 ($29.95)

Get a printed copy>>>

22.2  suEXEC Security Model

Before we begin configuring and installing suEXEC, we will first discuss the security model you are about to implement. By doing so, you may better understand what exactly is going on inside suEXEC and what precautions are taken to ensure your system’s security.

suEXEC is based on a setuid "wrapper" program that is called by the main Apache web server. This wrapper is called when an HTTP request is made for a CGI or SSI program that the administrator has designated to run as a userid other than that of the main server. When such a request is made, Apache provides the suEXEC wrapper with the program’s name and the user and group IDs under which the program is to execute.

The wrapper then employs the following process to determine success or failure – if any one of these conditions fail, the program logs the failure and exits with an error, otherwise it will continue:

  1. Is the user executing this wrapper a valid user of this system?

    This is to ensure that the user executing the wrapper is truly a user of the system.

  2. Was the wrapper called with the proper number of arguments?

    The wrapper will only execute if it is given the proper number of arguments. The proper argument format is known to the Apache web server. If the wrapper is not receiving the proper number of arguments, it is either being hacked, or there is something wrong with the suEXEC portion of your Apache binary.

  3. Is this valid user allowed to run the wrapper?

    Is this user the user allowed to run this wrapper? Only one user (the Apache user) is allowed to execute this program.

  4. Does the target CGI or SSI program have an unsafe hierarchical reference?

    Does the target CGI or SSI program’s path contain a leading ‘/’ or have a ‘..’ backreference? These are not allowed; the target CGI/SSI program must reside within suEXEC’s document root (see --with-suexec-docroot=DIR below).

  5. Is the target user name valid?

    Does the target user exist?

  6. Is the target group name valid?

    Does the target group exist?

  7. Is the target user NOT superuser?

    Presently, suEXEC does not allow root to execute CGI/SSI programs.

  8. Is the target userid ABOVE the minimum ID number?

    The minimum user ID number is specified during configuration. This allows you to set the lowest possible userid that will be allowed to execute CGI/SSI programs. This is useful to block out "system" accounts.

  9. Is the target group NOT the superuser group?

    Presently, suEXEC does not allow the root group to execute CGI/SSI programs.

  10. Is the target groupid ABOVE the minimum ID number?

    The minimum group ID number is specified during configuration. This allows you to set the lowest possible groupid that will be allowed to execute CGI/SSI programs. This is useful to block out "system" groups.

  11. Can the wrapper successfully become the target user and group?

    Here is where the program becomes the target user and group via setuid and setgid calls. The group access list is also initialized with all of the groups of which the user is a member.

  12. Can we change directory to the one in which the target CGI/SSI program resides?

    If it doesn’t exist, it can’t very well contain files. If we can’t change directory to it, it might aswell not exist.

  13. Is the directory within the Apache webspace?

    If the request is for a regular portion of the server, is the requested directory within suEXEC’s document root? If the request is for a UserDir, is the requested directory within the directory configured as suEXEC’s userdir (see suEXEC’s configuration options)?

  14. Is the directory NOT writable by anyone else?

    We don’t want to open up the directory to others; only the owner user may be able to alter this directories contents.

  15. Does the target CGI/SSI program exist?

    If it doesn’t exists, it can’t very well be executed.

  16. Is the target CGI/SSI program NOT writable by anyone else?

    We don’t want to give anyone other than the owner the ability to change the CGI/SSI program.

  17. Is the target CGI/SSI program NOT setuid or setgid?

    We do not want to execute programs that will then change our UID/GID again.

  18. Is the target user/group the same as the program’s user/group?

    Is the user the owner of the file?

  19. Can we successfully clean the process environment to ensure safe operations?

    suEXEC cleans the process’ environment by establishing a safe execution PATH (defined during configuration), as well as only passing through those variables whose names are listed in the safe environment list (also created during configuration).

  20. Can we successfully become the target CGI/SSI program and execute?

    Here is where suEXEC ends and the target CGI/SSI program begins.

This is the standard operation of the suEXEC wrapper’s security model. It is somewhat stringent and can impose new limitations and guidelines for CGI/SSI design, but it was developed carefully step-by-step with security in mind.

For more information as to how this security model can limit your possibilities in regards to server configuration, as well as what security risks can be avoided with a proper suEXEC setup, see the "Beware the Jabberwock" section of this section.

ISBN 9781906966034The Apache HTTP Server Reference ManualSee the print edition