From: Richard Bowen Date: Thu, 7 Nov 2002 03:03:33 +0000 (+0000) Subject: As per discussion on users@httpd.apache.org and a little on IRC, clarify X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ea19566ec902e0e6dcba0a1714f3f2713034f9ca;p=apache As per discussion on users@httpd.apache.org and a little on IRC, clarify that "third party" modules can do basically whatever they want, and typically do it as the "User" uid, so Caveat Administrator git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@97435 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/misc/security_tips.html.en b/docs/manual/misc/security_tips.html.en index 6ceccc3b9f..42db5d7e15 100644 --- a/docs/manual/misc/security_tips.html.en +++ b/docs/manual/misc/security_tips.html.en @@ -7,7 +7,7 @@ -->Security Tips - Apache HTTP Server

Modules | Directives | FAQ | Glossary | Sitemap

Apache HTTP Server Version 2.0

<-
Apache > HTTP Server > Documentation > Version 2.0

Security Tips

Some hints and tips on security issues in setting up a web server. Some of the suggestions will be general, others specific to Apache.

-
top

Permissions on ServerRoot Directories

+
top

Permissions on ServerRoot Directories

@@ -139,6 +139,18 @@

Most sites choose this option over the non script aliased CGI approach.

+
top

Other sources of dynamic content

+ + + +

+ Embedded scripting options which run as part of the server itself, + such as mod_php, mod_perl, mod_tcl, and mod_python, run under the + identify of the server itself, (see the User directive) and therefore + scripts executed by these engines potentially can access anything the + server user can. some scripting engines may provide restrictions, but + it is better to be safe and assume not.

+
top

Protecting System Settings

diff --git a/docs/manual/misc/security_tips.xml b/docs/manual/misc/security_tips.xml index ddc690c0ad..60dee63602 100644 --- a/docs/manual/misc/security_tips.xml +++ b/docs/manual/misc/security_tips.xml @@ -124,7 +124,7 @@ CGIWrap.

- +
Non Script Aliased CGI @@ -155,6 +155,21 @@

Most sites choose this option over the non script aliased CGI approach.

+
+ +
+ + Other sources of dynamic content + +

+ Embedded scripting options which run as part of the server itself, + such as mod_php, mod_perl, mod_tcl, and mod_python, run under the + identify of the server itself, (see the User directive) and therefore + scripts executed by these engines potentially can access anything the + server user can. some scripting engines may provide restrictions, but + it is better to be safe and assume not.

+