RE: [PHP-WIN] Windows XP IIS unable to fork
| From: | Bryan Thoreson | Date: | Wed, 23 Apr 2003 18:27:43 +0000 |
| Subject: | RE: [PHP-WIN] Windows XP IIS unable to fork | ||
| References: | 1 | Groups: | php.windows |
| Request: | Send a blank email to php-windows+get-19581@lists.php.net to get a copy of this message | ||
I have to send a command via cmd. I agree I'd rather not, but my ability to
make a client ssl connection to an ssl server this is my easiest route. I
have to send this ssl server "WEBCOOKIE tab base64_encoded cookie" to get
back a OK or NO string to verify if my user has authenicated properly with
our central auth system. Below is an example of my exec string:
cmd /c echo WEBCOOKIE\t".$cookie." | openssl.exe s_client -connect
".$HOSTNAME.":".$PORT." -quiet";
Again if I knew how to make a connection via openssl within PHP to this
server I'd rather do this, but I'm not skilled enough yet. And my
understanding from other php people this may not be possible yet. Someone
could verify that piece.
Any help with doing this inside php would be appreciated.
Bryan Thoreson
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Bryan Thoreson 04/23/2003
Infotech Professional
CLA OIT University of Minnesota
On Wed, 23 Apr 2003 16:36:29 +1000, Howard, Robert P wrote:
>You should NOT be allowing the IIS accounts to run cmd.exe. This is the
>LARGEST whole that can be opened for a Windows/IIS system.
>
>Regards
>Robert Howard
>
>-----Original Message-----
>From: Per Lundberg [mailto:per@nobolt.com]
>Sent: Wednesday, 23 April 2003 4:34 PM
>To: Bryan Thoreson
>Cc: php-windows@lists.php.net
>Subject: Re: [PHP-WIN] Windows XP IIS unable to fork
>
>
>On Tue, 2003-04-22 at 20:32, Bryan Thoreson wrote:
>>Looks like the IIS account cannot run anything in system32 by default.
>Allow
>>it to execute cmd.exe and I'm finally good to go. Stupid security.
>
>It is not stupid. Remember that Microsoft has had *lots* of security
>problems with IIS, especially with buffer overflows allowing remote
>users to run any program on your server.
>
>Be aware that changing this setting might be opening a can of worms.
>--
>Best regards,
>
>Per Lundberg / Capio ApS
>Phone: +46-18-4186040
>Fax: +46-18-4186049
>Web: http://www.nobolt.com
>
>##########################################################################
>###########
>This e-mail message has been scanned for Viruses and Content and cleared
>by MailMarshal
>##########################################################################
>###########