Re: [Full-disclosure] Apache suEXEC privilege elevation / inform
--HLVoWwxKalPAdH5guQhp9glQPJtVpdRSw
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Am 10.08.2013 16:52, schrieb Tobias Kreidl:
> It is for this specific reason that utilities like suPHP can be used as=
a powerful tool to at least keep the
> account user from shooting anyone but him/herself in the foot because o=
f any configuration or broken security
> issues. Allowing suexec to anyone but a seasoned, responsible admin is =
IMO a recipe for disaster.
and what makes you believe that a developer can not be a "seasoned, respo=
nsible admin"?
bullshit, many of the "seasoned, responsible admins" which are only admin=
s are unable
to really understand the implications of whatever config they rollout
> On 8/10/2013 7:25 AM, Reindl Harald wrote:
>>
>> Am 10.08.2013 12:10, schrieb Gichuki John Chuksjonia:
>>> One thing u gotta remember most of the Admins who handle webservers i=
n
>>> a network are also developers since most of the organizations will
>>> always need to cut on expenses, and as we know, most of the developer=
s
>>> will just look into finishing work and making it work. So if somethin=
g
>>> doesn't run due to httpd.conf, you will find these guys loosening
>>> server security, therefore opening holes to the infrastructure.
>> i am one of the developers who are admin
>>
>> why?
>>
>> because maintaining servers where only internal developed
>> software gives you the power to make security as tighten
>> as possible - and yes security is *always* first
>>
>> not the admins which are developers are the problem
>>
>> crap like wordpress, joomla, phpBB is the problem because
>> these developers have no idea how to secure maintain a
>> server and try to develop software which can be installed
>> by any random fool on whatever webserver without understand
>> the implications
>>
>> thats's why these applications are *strictly* forbidden
>> on any machine i am responsible for, it's enough to write
>> abuse mails each time one of these installations outside
>> got hacked and is starting attacks on 3rd parties
>>
>=20
>=20
--=20
Reindl Harald
the lounge interactive design GmbH
A-1060 Vienna, Hofm=FChlgasse 17
CTO / CISO / Software-Development
m: +43 (676) 40 221 40, p: +43 (1) 595 3999 33
icq: 154546673, http://www.thelounge.net/
http://www.thelounge.net/signature.asc.what.htm
--HLVoWwxKalPAdH5guQhp9glQPJtVpdRSw
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlIHaxIACgkQhmBjz394AnmyjwCggSrTtaFdjwJxr6RqQN79Fnf1
21AAn33ewYphq9mENaA4/rquminEg0Wt
=0kuG
-----END PGP SIGNATURE-----
--HLVoWwxKalPAdH5guQhp9glQPJtVpdRSw--
討論串 (同標題文章)
完整討論串 (本文為第 7 之 32 篇)：