Re: tlug: WebMin

[Frank Bennett <bennett@example.com>]

On Tue, Feb 09, 1999 at 10:13:54AM +0000, Darren Cook wrote:

> >> "Webmin is a web-based interface for system administration for Unix. Using
> >> any browser that supports tables and forms, you can setup user accounts,
> >> Apache, DNS, file sharing and so on. (www.webmin.com) ..."
> >
> >This sounds really hazardous; if the server/script is cracked by an
> >outsider, you've had it.
> 
> Is it really any worse than allowing telnet on your machine? With telnet if
> I can find one users password and the superusers password I can do lots of
> damage. Well with a web-based interface I still need to discover these
> don't I?

The problem, as I understand it, is that the Web server, running as root,
invokes the script, also running as root.  The Web server designers can
beef up security inside their daemon, but they have no control over the
external script process.  While I don't know the details that well myself,
the going wisdom is that SUID scripts are a bad thing, because there are
gadzillion ways of breaking them or exploiting them as agents of
misbehavior. In this case, breaking the script would yield root access to
the system.  Game over. 

Cheers,
-- 
-x80
Frank G Bennett, Jr         @@
Faculty of Law, Nagoya Univ () email: bennett@example.com
Tel: +81[(0)52]789-2239     () WWW:   http://rumple.soas.ac.uk/~bennett/

-------------------------------------------------------------------
Next Technical Meeting: February 13 (Sat), 12:30 place: Temple Univ.
** presentation: XEmacs, by Steven Baur and Martin Buchholz
Next Nomikai: March 19 (Fri), 19:30   Tengu TokyoEkiMae 03-3275-3691
-------------------------------------------------------------------
more info: http://tlug.linux.or.jp                     Sponsor: PHT