RE: [PHP] Symbolic link fails when User Authentication comes in

If you miswrite a CGI script and have lots of system calls, someone could send a command to your script that creates a link to, say, your password file, or something else, and then be able to view it through the web. If you have other users on the system the security hole opens wider. There are plenty of other reasons, as well. I would look for security information on various security websites, like insecure.org, securityfocus.com, etc.. Subscribe to some BUGTRAQ security lists. You will be surprised what is and is not a security hole. And, the more "features" you enable on your site, the more security concious you need to become. Your machine is *never* safe and enabling features opens more possibilities for abuse. If you have a linux box, you might want to try locking your system down a bit with portsentry and bastille linux: http://www.psionic.com/abacus/portsentry/ http://www.bastille-linux.org/ Just my humble and paranoid opinion from past experiences. :) johnny p. > -----Original Message----- > From: david klein [mailto:davidklein101@hotmail.com] > Sent: Wednesday, January 31, 2001 2:04 PM > To: johnny@gameloop.com; php-general@lists.php.net > Subject: RE: [PHP] Symbolic link fails when User > Authentication comes in > > > Johnny, > > It works, but how could this create a security hole? > Could you please > expalin a little bit more? > > Thanks, > David > > > >From: "johnny p." <johnny@gameloop.com> > >To: "david klein" <davidklein101@hotmail.com>, > <php-general@lists.php.net> > >Subject: RE: [PHP] Symbolic link fails when User > Authentication comes in > >Date: Wed, 31 Jan 2001 13:54:22 -0600 > > > >Add the FollowSymLinks to your httpd.conf file for that directory. I > >don't recommend doing this, tho, since it *is* a security hole. > > > > <Directory /apps/apache/docs/test1> > > Options Indexes FollowSymLinks > > </Directory> > > > >johnny p. > > > > > -----Original Message----- > > > From: david klein [mailto:davidklein101@hotmail.com] > > > Sent: Wednesday, January 31, 2001 1:43 PM > > > To: php-general@lists.php.net > > > Subject: [PHP] Symbolic link fails when User > Authentication comes in > > > > > > > > > I am using Apache user authentication, and it works fine. > > > However, if there > > > is a symbolic link inside a securied directory, the symbolic > > > linked file > > > will deny any access. > > > > > > For example, directory "/apps/apache/docs/test1" is a > > > securied directory, > > > and there is a symbolic linked file "file1.txt", after you > > > logged into > > > directory "/apps/apache/docs/test1" and try to access > > > "file1.txt", you will > > > be denied for the access? > > > > > > Does anyone have any idea? > > > > > > Thanks, > > > David > > > _________________________________________________________________ > > > Get your FREE download of MSN Explorer at > > > http://explorer.msn.com > > > > > > > > > -- > > > PHP General Mailing List (http://www.php.net/) > > > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > > > For additional commands, e-mail: php-general-help@lists.php.net > > > To contact the list administrators, e-mail: > > > php-list-admin@lists.php.net > > > > > > > > > > > >-- > >PHP General Mailing List (http://www.php.net/) > >To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > >For additional commands, e-mail: php-general-help@lists.php.net > >To contact the list administrators, e-mail: > php-list-admin@lists.php.net > > > > _________________________________________________________________ > Get your FREE download of MSN Explorer at > http://explorer.msn.com > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: > php-list-admin@lists.php.net > >