How to run CGI script as a certain user without using Virtual Domain.

Posted on 2003-02-27
Medium Priority
Last Modified: 2013-12-25
Hi experts.  I am a bit confused here.
Apache 1.3, Perl 5.6.1

I want to run Mailman(listserv) scripts from a perl cgi script.  The mailman scripts need to be run as either "root" or "list" to execute properly.

I got it to work when I setup the domain name to run as the user "list" in the apache virtual hosts setup.  But I would rather not do it this way since I may want to run something else as a different user down the road.

Is there a way to setup the web page to ask for a username on the page, that will run the script as that user? Or, can I just set the script somehow to run as a certain user?  Like sudo? I would like it to be automatic, but that might be a security problem, so if I had to login to the page that would be ok I guess.

So if I initate the cgi script from a HTML page, would this all work ok.  Is security a problem doing this?

Thanks Experts!

Question by:Airgazm
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Accepted Solution

zerofill earned 300 total points
ID: 8040920
Here is the situation:
The Apache is running as a daemon with a privileges of a certain user, usualy "nobody". As a parent process it executes CGI scripts as a child processes which means CGIs are executed as the same user as Apache's one.
If you run Apache as root your scripts will be executed as root and they will work. BUT THIS IS VERY INSECURE and not a decision of the problem. Nobody do such a silly thing.
My suggestion is to continue running Apache as nobody or whatever your user is. Divide your cgi on two parts. One to be the cgi executed through http via the browser. The other part to be a perl (or other) script somewhere on server (recomended outside wwwroot for security reasons). When user executes the cgi, it (cgi) must execute the "script" (see below why is in quotes), which is set to run as a different user. You must be the user you want the script to be executed and then "chmod u+s file". I don't know how or is it possible to chmod u+s scriptfile but you can do such thing on alredy binary executable. So write it down in c/c++ or something else and compile it. Then chmod u+s and you are ready.
I am not sure how to chmod perl script but it may be possible. If you know how let me know.
Good luck
LVL 51

Expert Comment

ID: 8049152
you may chown and chmod as suggested by zerofill, butkeep in mind that apache needs to be configured to allow SUID scripts too.

Or you may call your script fromwithin aour existing perl cgi as follows:


Author Comment

ID: 8131494
Thanks for the Help!

Featured Post

Enroll in August's Course of the Month

August's CompTIA IT Fundamentals course includes 19 hours of basic computer principle modules and prepares you for the certification exam. It's free for Premium Members, Team Accounts, and Qualified Experts!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this tutorial I will focus on how to use WhizBase as a tool for sending ICQ messages to ICQ. Here I will use a new technology in WhizBase, published in WhizBase 5.1 version. In this tutorial I will use 3 files, pager.wbsp for the processing, e…
Active Directory replication delay is the cause to many problems.  Here is a super easy script to force Active Directory replication to all sites with by using an elevated PowerShell command prompt, and a tool to verify your changes.
The viewer will learn how to count occurrences of each item in an array.
In a recent question (https://www.experts-exchange.com/questions/29004105/Run-AutoHotkey-script-directly-from-Notepad.html) here at Experts Exchange, a member asked how to run an AutoHotkey script (.AHK) directly from Notepad++ (aka NPP). This video…
Suggested Courses

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question