Re: TUX & CGI

On Tue, 2003-08-19 at 04:16, n n wrote:
> > DOCROOT=/var/www/html
> > CGIROOT=/
> > 
> > If CGIROOT is not set to the root directory, TUX
> > will spit out the
> > chroot error complaining that cgiroot is not set
> > correctly.
> 
> In fact this is dangerous what you did.  I would
> highly recommend you use your cgi as chroot.  You
> don't want someone with skilz cracking your box.  It
> is bad enough that tux runs in kernel space.
> 
> Tux notes: "CGIROOT=/ if you want CGI programs to have
> access to the *whole* system".  IMHO that is a warning
> not a suggestion.
> 

Yes, I absolutely agree that it is dangerous.But it seems to be
necessary.

As you mention, you have Apache running in addition to TUX, which is the
normal and intended setup. In that case all the steps I mentioned are
not necessary (and that makes we wonder if it is really TUX serving the
CGI and static files, or whether it is also just passing those requests
to Apache).

In my case, I want to run TUX stand-alone. I just need to serve one CGI
file which is requested maybe once per week. For such a trivial matter,
I do not want to install Apache's overhead, since all I need is already
in the kernel.

The reason for putting these step-by-step instructions on the mailing
list was because I could not get TUX to serve CGI scripts. I checked the
list and found a few questions about whether anybody had actually gotten
TUX to do that, but no answers. By chance I found a solution, so I
posted it.This is a workable solution, but definitely not a secure one
(another problem lies with the bind mounts, for example).

If anybody can show a way to have TUX serve CGI scripts in a secure but
__simple__ manner, I will be more than happy to implement that on my
system.

-- 
S. Christians