there is IMHO a serious security leak in the ncsa httpd.
We run httpd from inetd and I always thought (but never checked)
that User and Group (from the conf oder httpd.h files) applies
in that case, too.
This is NOT true! (and should be stated clearly in the conf files
You could now argue to use the "user" entry in the inetd.conf file,
- I can't set the gid there
- some older systems don't support this (yet)
Rob, could you please add the code from the standalon section to
the inetd section?!
This all doesn't solve a more serious problem with the <INC>
Having user-directories configured, any user is able to execute ANY
command out of this document, and this command is run under
This should IMHO be changed to only allow starting of programs
out of .../cgi-bin/ for example.
-- ______________________________________________________________________________ Markus Stumpf Markus.Stumpf@Informatik.TU-Muenchen.DE http://www.informatik.tu-muenchen.de/~stumpf/