Re: Apache suexec problem

2 msg	ipsec.conf question
1 msg	pbm install 4.3 Packard Bell EasyNote

Apache suexec problem
\ Chris Bennett (5 May 2008)
. \ Chris Bennett (5 May 2008)
. . \ Chris Bennett (5 May 2008)
. . . \ Marc Espie (5 May 2008)
. \ Dan Harnett (5 May 2008)
. . \ Chris Bennett (5 May 2008)
. . . \ Dan Harnett (5 May 2008)
. . . . \ Louis V. Lambrecht (5 May 2008)
. \ Stuart Henderson (5 May 2008)
. . \ Chris Bennett (5 May 2008)
. \ Chris Bennett (5 May 2008)

9 msg	1U IBM or Dell server for firewall
1 msg	gtk+2-2.12.7 on't upgrade after upgrade to 4.3
4 msg	colors in regular openbsd terminal
7 msg	problem building release for 4.3 stable
18 msg	Window Manager
2 msg	What tarball is xlib.h in in 4.3?
5 msg	newfs during install
1 msg	Mehr Insolvenzen in den USA
11 msg	Jack, sun and envy problem
5 msg	mknod fails after wrong arch MAKEDEV
3 msg	mplayer & snapshot install
7 msg	OpenBSD 4.3 and Xorg resolution 1280x800?
1 msg	Good news re: Flash9
37 msg	Doubt about license
2 msg	source/destination nat pf, user space filtering pf
61 msg	Editing C with...
2 msg	4.2, ppp problem

Subject:	Re: Apache suexec problem
Group:	Openbsd-misc
From:	Louis V. Lambrecht
Date:	5 May 2008

Dan Harnett wrote:
> On Mon, May 05, 2008 at 11:39:03AM -0500, Chris Bennett wrote:
>
>> Actually I didn't, checked that right after I posted, BUT it was
>> already set as setuid!! A mistake in release??
>>
>
> No. There is no mistake.
>
> $ sudo chmod u+s /usr/sbin/suexec
> $ ls -l /usr/sbin/suexec
> -r-sr-xr-x 1 root bin 12068 Mar 12 12:41 /usr/sbin/suexec
> $ ftp -V -o - $MIRROR/pub/OpenBSD/4.3/i386/base43.tgz \
> | sudo tar zxphf - -C /
> $ ls -l /usr/sbin/suexec
> -r-xr-xr-x 1 root bin 12068 Mar 12 12:41 /usr/sbin/suexec
>
>
> Are you running in a chroot?
>
>
>
Ha!
I understand setuid and UID/Gid root/bin for suexec,
but shouldn't the executables be made www/www with authorized users
members of www group?

Default suexec -V
shows no access for UID/GID < 1000, so www would not work either.

Also, suexec -V shows public_html enabled, just need to edit the
httpd.cong to allow it also.
Again a problem as / and .. are disallowed, so, no Perl.

The manual page on the local Apache server have been written by
linguists, not eager to learn
computer users.

Redaing the thread, I understand I am not the only unfortunate. Sadly said.