Re: [us...@httpd] url rewrite help

2010-08-12 Thread David Ricar
Error pages are set in apache configs too, so just change that line... Matthew P. Smith wrote: Hi, I have this in the conf: IfModule dir_module DirectoryIndex index.cfm /IfModule I am running coldfusion 9. I am tyring to use the onMissingTemplate function to call a custom 404. The

Re: [us...@httpd] suexec for another user

2010-08-12 Thread Phil Howard
On Wed, Aug 11, 2010 at 18:24, David Ricar r...@ethernet.cz wrote: Phil Howard wrote: For maintenance, it might be easier for you to make an suexec wrapper.  Run your wrapper to do custom checks and if it decides to go on, it runs suexec.  That way your maintenance is for your program, only,

Re: [us...@httpd] suexec for another user

2010-08-12 Thread David Ricar
Phil Howard wrote: By suexec wrapper, I mean a program you write which will be placed where Apache expects to find suexec. The real suexec will be moved to somewhere else (maybe real-suexec in the same directory). Your program will know where it is (and probably hard code that). Your program

Re: [us...@httpd] Need help with VirtualHost/forwarding

2010-08-12 Thread Mike Soultanian
On 8/12/2010 6:28 AM, Phil Howard wrote: Our current site is here on server F (failing server): It looks like a whole different subnet, so I assume it is running within your department. Nope, different department with different admins. Plus, the administrator for server F has taken a new

Re: [us...@httpd] Need help with VirtualHost/forwarding

2010-08-12 Thread Phil Howard
On Thu, Aug 12, 2010 at 10:37, Mike Soultanian msoul...@csulb.edu wrote: server - the problem is that it can't be done for another couple weeks (IT department won't do it right away as it involves restarting all of the servers and a whole change management process). Remind me to not ever

Re: [us...@httpd] Need help with VirtualHost/forwarding

2010-08-12 Thread Mike Soultanian
On 8/12/2010 9:33 AM, Phil Howard wrote: No backup staff ... ouch. budget cuts? :) If they have load balancing, the restarts can be made transparent. Just disable the server from the load balancer, wait the prescribed honestly, this is so far out of my area that I don't get involved. They

Re: [us...@httpd] suexec for another user

2010-08-12 Thread Phil Howard
On Thu, Aug 12, 2010 at 09:49, David Ricar r...@ethernet.cz wrote: I need just one thing: replace others writable tests by is_in_homedir test - suexec does not solve, who could rewrite the code, but where the code is located. My patch is rather naive and dirty proof of concept right now, I

Re: [us...@httpd] Need help with VirtualHost/forwarding

2010-08-12 Thread Phil Howard
On Thu, Aug 12, 2010 at 12:41, Mike Soultanian msoul...@csulb.edu wrote: On 8/12/2010 9:33 AM, Phil Howard wrote: No backup staff ... ouch. budget cuts? :) Down to one administrator, I assume. there is no plan to get them out of that folder - www.csulb.edu/colleges/cota is the final

Re: [us...@httpd] suexec for another user

2010-08-12 Thread David Ricar
Phil Howard wrote: I don't understand what it is you are doing, so I cannot comment on whether it is common or not, or even secure. A test to detect if others can write a file that would be executed is a critical test on a multi-user machine. Similarly, testing if all parent directories can be

Re: [us...@httpd] suexec for another user

2010-08-12 Thread Phil Howard
On Thu, Aug 12, 2010 at 13:02, David Ricar r...@ethernet.cz wrote: [...] Sorry, I'm still not understanding what you are doing. I didn't understand why you need two users per each site. -- sHiFt HaPpEnS! - The official

Re: [us...@httpd] suexec for another user

2010-08-12 Thread J. Greenlees
David Ricar wrote: Hello, ~snip~ So my concept is based on two basic users for every website - one for ftp and another for suexec run. Homedir of both is one level above any website data and it is owned by root, ftp is chrooted there. If suexec would be able to just check if code is in users

Re: [us...@httpd] suexec for another user

2010-08-12 Thread David Ricar
Phil Howard wrote: On Thu, Aug 12, 2010 at 13:02, David Ricar r...@ethernet.cz wrote: [...] Sorry, I'm still not understanding what you are doing. I didn't understand why you need two users per each site. J. Greenlees wrote: I believe the standard method of doing this to completely lock the