Skip to Content.
Sympa Menu

internetworkers - Re: [internetworkers] man Unix

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: Steven Champeon <schampeo AT hesketh.com>
  • To: internetworkers AT lists.ibiblio.org
  • Subject: Re: [internetworkers] man Unix
  • Date: Thu, 26 Dec 2002 14:47:20 -0500

on Thu, Dec 26, 2002 at 01:31:20PM -0500, machett AT ibiblio.org wrote:
> I have a sysadmin question, or series of questions, for whomever can
> help me. Although I have enjoyed the commercial hosting company I use,
> it has suddenly come to my attention that their security might be
> severely lacking. If true, this would be a disappointment, but would
> be reason to dump them. Not having a firm grasp of the cgi process, I
> need someone else's opinion.

CGI isn't a process, it's just an API of sorts. It exposes a few basic
standard bits of information from the client to the server, allows for
subshells to be spawned by the server, running arbitrary programs, and
usually also involves stdout/stderr redirection, so you can write to the
server's logs and send data back to the client.

<snip>

> While working with their gui Unix interface (my first mistake, I
> realize; I should ssh into my account and do these things on my own,
> but I *really* like a gui, and I had (apparantly falsely) believed
> their interface to be secure) and while composing web based email, I
> noticed the following:

> (1)the urls contained, in plain text, my userid and password:
> Example:
> http://helpbot.com/cgi-bin/cgiwrap/lower/brain.cgi?&userid=NNNNN&password=XXXXX

Oh, that's brilliant. And not protected by SSL, either? Lovely. At least
they're using cgiwrap, though - I wonder if it's configured correctly?

The hazard here is that your userid and password will be logged in the
access logs of the server, if they're logging referers, and otherwise is
visible to anyone sniffing the network between you and them. And while
it's handy that you can bookmark the URL (and that's probably why they did
it that way) it's also a security risk in that anyone can log in to check
your mail if they have that URL.

> (2)the page source code contained, in plain text, my userid and password
> Example:
> <INPUT TYPE="hidden" NAME="username" VALUE="NNNNN">
> <INPUT TYPE="hidden" NAME="password" VALUE="XXXXX">

Dumb, but not uncommon.

> (3)I hadn't really thought about it before, but a friend pointed out
> to me that I have my own cgi-bin in my home directory.

That's not a big deal, depending on how things are configured.

> The rather lax response has me a bit worried, also. What does anyone think?

Eh, they really ought to have things protected by way of SSL, and it'd
be nice if they used sessions instead of query string variables and form
data to store user/pass, and it'd be better if they used some form of
hash to disallow access from another IP/host for the duration of the
session, but as with all things, security is a matter of how much you
want to pay, how much it matters to you (or to them) that someone else
can read your data, and how attractive a target you present.

If it bothers you, and it very well may, find another provider or
pressure this one into at least setting up an SSL server to protect the
worst of their security holes. The biggest problem here isn't what
you've outlined above, but that if they don't care about the obvious
things, they may not really be working very hard to protect less
obvious, and potentially more dangerous, services.

Steve

--
hesketh.com/inc. v: (919) 834-2552 f: (919) 834-2554 w: http://hesketh.com
Book publishing is second only to furniture delivery in slowness. -b. schneier




Archive powered by MHonArc 2.6.24.

Top of Page