Re: FastCgiExternalServer and FastCgiWrapper

Re:
http://www.fastcgi.com/archives/fastcgi-developers/2006-December/004594.html

Mr Bock:

I'm using Apache 1.3.x instead of Apache 2, but I've been racking my head
for two days having the exact same problem you are.  For security reasons, I
need dynamic fastcgi servers to be filtered through suexec and run as the
correct user, but I ALSO need certain applications to hit the external
fastcgi server.

The FastCgiExternalServer and FastCgiSuexec directive are mutually exclusive
and don't work together as they ought to or as you would expect them to.  If
I set "FastCgiSuexec Off" then the ExternalServer suddenly works perfectly,
but then all the dynamic scripts run as the default apache user instead of
through the wrapper as they should.

Terribly frustrating!

I finally got everything working, but I had to actually repair the source
code.  I'm not sure if it's the best solution, but it fixed all the problems
perfectly and didn't create any new problems nor does it open up any
security holes.  I've even tried hitting the exact same SCRIPT_FILENAME
fastcgi script for different VirtualHost block with different users and it
still spawns separate fastcgi servers as it ought to.  Here is the magic
security patch:

wget -N
http://trogdor.bluehost.com/mod_fastcgi.SECURITY_FastCgiExternalServer.patch
patch -p1 < mod_fastcgi.SECURITY_FastCgiExternalServer.patch

Or just manually remove that one devil line if you are not confortable with
patches:

--- mod_fastcgi-2.4.2-SECURITY_HOLE_WITH_FastCgiExternalServer/fcgi_util.c
2003-10-29 18:08:34.000000000 -0700
+++ mod_fastcgi-2.4.2/fcgi_util.c       2006-12-20 15:11:51.000000000 -0700
@@ -326,7 +326,6 @@
             continue;
         }
         if (path[i] == '\0' || path[i] == '/') {
-        if (fcgi_wrapper == NULL || (uid == s->uid && gid == s->gid))
             return s;
         }
     }


For security reasons, I highly recommend that the fastcgi developers apply
this patch to the core code if an equivalent solution has not already been
implemented.  This should repair the problems for both Apache 1.3.x and
Apache 2 servers.

Or let me know if you know of a better solution.

-- Rob Brown
BlueHost.Com

___________________________________
fastcgi-developers mailing list
http://fastcgi.com/fastcgi-developers/