cgiwrap-users

[cgiwrap-users] apache 2.0

[Andrew S. <as...@ta...>]

Is php-cgiwrap working in apache 2.0?  I've tried on two different
systems now and couldn't get either to work.  However, I'm also thinking
it may be because --enable-discard-path was not configured into the
version of PHP I'm using with Apache 2.0, but I don't have my old
install where php-cgiwrap was working to check. 

any thoughts?

Thanks,

Andrew

[cgiwrap-users] Small help document

[iamsock <ia...@te...>]

I've got a lot of trouble configuring cgi-wrap, after reading all the 
web site documentation, and found some things that we'rent clear, nor 
documented. Use it as you wan't, mention the source.

Re: [cgiwrap-users] Problems with PATH_TRANSLATED

[Greg B. <sys...@ci...>]

On Wednesday 19 May 2004 01:00 pm, Tom Myny wrote:
>Hi Guys,
>
>Can i use cgiwrap where the username is not in the webpath ?

Yes, you just need to have Apache add the username back in via a rewrite.

For example, to make "www.yoursite.com/w/" go to the wiki user:

        # Wiki
        RewriteRule ^/w/(.*) /~wiki/$1 [N,PT]

Also, you can put the username right on the end of the Action directive if you 
want:

	Action cgi-wrapper /global-cgi-bin/cgiwrap/user001

This is what we do for virtual domains

Greg

>
>Example:
>
>----
>
>Initializing Logging
>Redirecting STDERR to STDOUT
>
>Setting SIGXCPU to default behaviour
>
>Limiting (cpu time) to (30)
>
>Limiting (number of processes) to (15)
>
>Limiting (number of open files) to (30)
>
>Limiting (lockable memory) to (200000)
>
>
>Environment Variables:
>     QUERY_STRING: ''
>      SCRIPT_NAME: '/cgi-sys/cgiwrapd'
>  SCRIPT_FILENAME: '/usr/local/apache/cgi-sys/cgiwrapd'
>     REDIRECT_URL: '/cgi-bin/cam.cgi'
>        PATH_INFO: '/web-peterpm/cgi-bin/cam.cgi'
>  PATH_TRANSLATED:
>'/lns/peterpm/web/mooring.be/www/web-peterpm/cgi-bin/cam.cgi'
>      REMOTE_USER: '<NULL>'
>      REMOTE_HOST: 'u81-11-142-123.adsl.scarlet.be'
>      REMOTE_ADDR: '81.11.142.123'
>
>
>Trying to extract user from PATH_INFO.
>Retrieved User Name:  'web-peterpm'
>
>User Data Retrieved:
>     UserID: 'web-peterpm'
>        UID: '1528'
>        GID: '1000'
>   Home Dir: '/lns/peterpm'
>Checking user minimum uid.
>
>Script Base Directory:  '/lns/peterpm/web'
> Fetching script string
>
>Trying to extract script from PATH_INFO
>Extracted PATH_INFO '/cgi-bin/cam.cgi'
>
>*****************
>* CGIWrap Error *
>*****************
>
>Script File Not Found!
>
>----
>
>The correct path must be: /lns/peterpm/web/mooring.be/www/cgi-bin/cam.cgi'
>(and not '/lns/peterpm/web/mooring.be/www/web-peterpm/cgi-bin/cam.cgi' )
>Is this possible (by a patch or something) ? (if I remove the name in my
>apache config it can't find the user ...)
>
>Current apache config:
>
>Action cgi-wrapper /cgi-sys/cgiwrapd/web-peterpm
>ScriptAlias /cgi-bin/ "/lns/peterpm/web/mooring.be/www/cgi-bin/"
>
>I hope somebody know this :)
>
>Best regards,
>Tom
>
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by: Oracle 10g
>Get certified on the hottest thing ever to hit the market... Oracle 10g.
>Take an Oracle 10g class now, and we'll give you the exam FREE.
>http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
>_______________________________________________
>cgiwrap-users mailing list
>cgi...@li...
>https://lists.sourceforge.net/lists/listinfo/cgiwrap-users

[cgiwrap-users] Need a little help getting started

[<cn...@ny...>]

  The server encountered an internal error or
  misconfiguration and was unable to complete your
  request.

Well, yeah, I imagine I _am_ misconfigured.  I'm sure I'm missing some steps.

I looked around http://cgiwrap.unixtools.org/ and couldn't find a simple example.  If I started with:

   /cgi-bin/something.cgi

and it was working and I want to add cgiwrap to the mix, what do I need to do?  If there's a step-by-step example, I missed it and a pointer to it would be quite enough to get started.  Thanks.

                             Chris

[cgiwrap-users] Problems with PATH_TRANSLATED

[Tom M. <to...@li...>]

Hi Guys,

Can i use cgiwrap where the username is not in the webpath ?

Example:

----

Initializing Logging
Redirecting STDERR to STDOUT

Setting SIGXCPU to default behaviour

Limiting (cpu time) to (30)

Limiting (number of processes) to (15)

Limiting (number of open files) to (30)

Limiting (lockable memory) to (200000)


Environment Variables:
     QUERY_STRING: ''
      SCRIPT_NAME: '/cgi-sys/cgiwrapd'
  SCRIPT_FILENAME: '/usr/local/apache/cgi-sys/cgiwrapd'
     REDIRECT_URL: '/cgi-bin/cam.cgi'
        PATH_INFO: '/web-peterpm/cgi-bin/cam.cgi'
  PATH_TRANSLATED:
'/lns/peterpm/web/mooring.be/www/web-peterpm/cgi-bin/cam.cgi'
      REMOTE_USER: '<NULL>'
      REMOTE_HOST: 'u81-11-142-123.adsl.scarlet.be'
      REMOTE_ADDR: '81.11.142.123'


Trying to extract user from PATH_INFO.
Retrieved User Name:  'web-peterpm'

User Data Retrieved:
     UserID: 'web-peterpm'
        UID: '1528'
        GID: '1000'
   Home Dir: '/lns/peterpm'
Checking user minimum uid.

Script Base Directory:  '/lns/peterpm/web'
 Fetching script string

Trying to extract script from PATH_INFO
Extracted PATH_INFO '/cgi-bin/cam.cgi'

*****************
* CGIWrap Error *
*****************

Script File Not Found!

----

The correct path must be: /lns/peterpm/web/mooring.be/www/cgi-bin/cam.cgi'
(and not '/lns/peterpm/web/mooring.be/www/web-peterpm/cgi-bin/cam.cgi' )
Is this possible (by a patch or something) ? (if I remove the name in my
apache config it can't find the user ...)

Current apache config:

Action cgi-wrapper /cgi-sys/cgiwrapd/web-peterpm
ScriptAlias /cgi-bin/ "/lns/peterpm/web/mooring.be/www/cgi-bin/"

I hope somebody know this :)

Best regards,
Tom

[cgiwrap-users] Problems with PATH_TRANSLATED

[Tom M. <to...@li...>]

Hi Guys,

Can i use cgiwrap where the username is not in the webpath ?

Example:

----

Initializing Logging
Redirecting STDERR to STDOUT

Setting SIGXCPU to default behaviour

Limiting (cpu time) to (30)

Limiting (number of processes) to (15)

Limiting (number of open files) to (30)

Limiting (lockable memory) to (200000)


Environment Variables:
     QUERY_STRING: ''
      SCRIPT_NAME: '/cgi-sys/cgiwrapd'
  SCRIPT_FILENAME: '/usr/local/apache/cgi-sys/cgiwrapd'
     REDIRECT_URL: '/cgi-bin/cam.cgi'
        PATH_INFO: '/web-peterpm/cgi-bin/cam.cgi'
  PATH_TRANSLATED:
'/lns/peterpm/web/mooring.be/www/web-peterpm/cgi-bin/cam.cgi'
      REMOTE_USER: '<NULL>'
      REMOTE_HOST: 'u81-11-142-123.adsl.scarlet.be'
      REMOTE_ADDR: '81.11.142.123'


Trying to extract user from PATH_INFO.
Retrieved User Name:  'web-peterpm'

User Data Retrieved:
     UserID: 'web-peterpm'
        UID: '1528'
        GID: '1000'
   Home Dir: '/lns/peterpm'
Checking user minimum uid.

Script Base Directory:  '/lns/peterpm/web'
 Fetching script string

Trying to extract script from PATH_INFO
Extracted PATH_INFO '/cgi-bin/cam.cgi'

*****************
* CGIWrap Error *
*****************

Script File Not Found!

----

The correct path must be: /lns/peterpm/web/mooring.be/www/cgi-bin/cam.cgi'
(and not '/lns/peterpm/web/mooring.be/www/web-peterpm/cgi-bin/cam.cgi' )
Is this possible (by a patch or something) ? (if I remove the name in my
apache config it can't find the user ...)

Current apache config:

Action cgi-wrapper /cgi-sys/cgiwrapd/web-peterpm
ScriptAlias /cgi-bin/ "/lns/peterpm/web/mooring.be/www/cgi-bin/"

I hope somebody know this :)

Best regards,
Tom

RE: [cgiwrap-users] Cross compiling

[Neulinger, N. <nn...@um...>]

Sure, I can integrate that back in if you get a clean diff...=20

The build for cgiwrap is very simplistic, so it shouldn't be that hard.=20

-- Nathan

------------------------------------------------------------
Nathan Neulinger                       EMail:  nn...@um...
University of Missouri - Rolla         Phone: (573) 341-6679
UMR Information Technology             Fax: (573) 341-4216
=20

> -----Original Message-----
> From: cgi...@li...=20
> [mailto:cgi...@li...] On Behalf=20
> Of cn...@ny...
> Sent: Wednesday, May 19, 2004 12:57 PM
> To: cgi...@li...
> Subject: [cgiwrap-users] Cross compiling
>=20
> I'd like to have CGIwrap built for an embedded Linux system. =20
> All the rest of my development for that system is done with a=20
> cross compiler (I don't have tools on the embedded system)=20
> but the configure script for cgiwrap doesn't seem to support=20
> cross compilation.  Any pointers?  If I decided that I wanted=20
> to modify configure.in to support cross compilation, would=20
> that be a good thing that would get put back into the=20
> disribution?  Has anyone else tried that?
>=20
>                               Chris
>=20
>=20
>=20
> -------------------------------------------------------
> This SF.Net email is sponsored by: SourceForge.net Broadband
> Sign-up now for SourceForge Broadband and get the fastest
> 6.0/768 connection for only $19.95/mo for the first 3 months!
> http://ads.osdn.com/?ad_id=3D2562&alloc_id=3D6184&op=3Dclick
> _______________________________________________
> cgiwrap-users mailing list
> cgi...@li...
> https://lists.sourceforge.net/lists/listinfo/cgiwrap-users
>=20
>=20

[cgiwrap-users] Cross compiling

[<cn...@ny...>]

I'd like to have CGIwrap built for an embedded Linux system.  All the rest of my development for that system is done with a cross compiler (I don't have tools on the embedded system) but the configure script for cgiwrap doesn't seem to support cross compilation.  Any pointers?  If I decided that I wanted to modify configure.in to support cross compilation, would that be a good thing that would get put back into the disribution?  Has anyone else tried that?

                              Chris

Re: [cgiwrap-users] limiting memory usage for PHP as CGI

[Florian E. <fl...@ar...>]

Hi Peter,

I even tried RLimitCPU 2 2.
With your current configuration, could you please try (but only if this is a
non-production machine as it can CRASH the server!!) hit Ctrl+R (for reload)
for about five to ten seconds and watch your load with a tool like top?
Does this work for you? For me, load went to really high values, highest was
90(!).

Thanks!
Florian

Re: [cgiwrap-users] limiting memory usage for PHP as CGI

[Peter M. J. <pe...@cl...>]

On Thu, 22 Apr 2004, Florian Effenberger wrote:

> Thanks for your reply. Isn't there anything I can do without patching the
> kernel? Maybe something in httpd.conf or via cgiwrap? Or is there generally
> no protection against such an "attack"?

I've successfully used "RLimitCPU 10 20" in Apache 2.x on Linux to 
constrain all CGI processes to no more than 20 seconds of CPU, and I run 
PHP scripts as CGI to gain UID isolation.  I've never tried the RLimitMEM.  
Could it be that, when you configured it, you used the wrong units?  
Perhaps it needs pages rather than bytes or something.

Re: [cgiwrap-users] limiting memory usage for PHP as CGI

[Florian E. <fl...@ar...>]

Hi Piotr,

> IMHO setrlimit limits resources for one process (and/or its children),
> that is why limiting it from Apache or php.ini (or cgiwrap) does not work
> for group of independent processes.

That could be possible, indeed. The Apache documentation is somewhat unclear
regarding this.

I'll try writing a wrapper script. If you have any place where I can get an
already one, please let me know ;-)

Thanks!
Florian

Re: [cgiwrap-users] limiting memory usage for PHP as CGI

[Florian E. <fl...@ar...>]

Hi Nathan,


> At one point I remember reading about a kernel patch for per-user
> process and resource limits, but I don't remember what it was.
> I know for sure that it wasn't in the standard linux kernel.

Thanks for your reply. Isn't there anything I can do without patching the
kernel? Maybe something in httpd.conf or via cgiwrap? Or is there generally
no protection against such an "attack"?

Thanks!
Florian

Re: [cgiwrap-users] limiting memory usage for PHP as CGI

[Piotr K. <ma...@ma...>]

On Wed, Apr 21, 2004 at 06:30:34PM +0200, Florian Effenberger wrote:
> thanks for your reply, that would be an idea. However, it does not solve the
> problem, especially for "foreign" scripts which cannot be modified. Do you
> have any idea on how to enforce a limit on the system it self?

IMHO setrlimit limits resources for one process (and/or its children),
that is why limiting it from Apache or php.ini (or cgiwrap) does not work
for group of independent processes.

If you can not change a script, you can:
- write a wrapper script, that would first check the system memory usage etc.
  then would run the proper script (require 'any.php' or something like that).
- write a wrapper script, that would wait for a lock file, then ... require 'any.php'

- use something like http://www.snert.com/Software/mod_throttle/
  at the Apache level for limiting the number of requests per period

Best regards,

-- 
Piotr Klaban

Re: [cgiwrap-users] limiting memory usage for PHP as CGI

[Florian E. <fl...@ar...>]

Hi Piotr,

thanks for your reply, that would be an idea. However, it does not solve the
problem, especially for "foreign" scripts which cannot be modified. Do you
have any idea on how to enforce a limit on the system it self?

Thanks!
Florian

[cgiwrap-users] Adding version to cgiwrapd

[Anders E. <and...@mo...>]

Hello!

My ISP is using cgiwrap and every now and then there is some strange errors
with it. The error often is due to some configuration error, but it always
takes a very long time before this is recognized by the ISP.

If cgiwrap would tell me which version that is running it would help a lot.
Then I would know if the ISP has upgraded cgiwrap or changed some
configuration.

Please add the version to the text that is shown when you run cgiwrapd


// Anders

Re: [cgiwrap-users] limiting memory usage for PHP as CGI

[Piotr K. <ma...@ma...>]

On Tue, Apr 20, 2004 at 09:59:46PM +0200, Florian Effenberger wrote:
> I re-load the
> script for five seconds continuously. It soaks up all my memory and runs for
> nearly a minute multiple times. I've tried to limit that via php.ini's
> memory limit setting and via Apache's RLimitCPU/RLimitNPROC/RLimitMEM
> directive, but it does not seem to work.
> 
> Do you have any idea of what can be done in order to protect myself from
> such an "attack"?

You can check the memory usage (/proc/meminfo) and/or load average
(cat /proc/loadavg) in the begining of the PHP script. If the memory
usage exceeds a limit or load average is too high, output the text/html error message.

You can also look for the php scripts running - if there are running
more than X php scripts - stop execution of the current script:
I mean something like:
find /proc -name cmdline -xdev -maxdepth 2 -user apache | \
  xargs perl -nle 's/\x00/ /g; print "$_"' | \
  grep php | wc -l

Best regards,

-- 
Piotr Klaban

[cgiwrap-users] limiting memory usage for PHP as CGI

[Florian E. <fl...@ar...>]

Hello PHP users,

I have PHP running as CGI with Apache 2.0.49 on Linux 2.4.26 here, and with
a huge PHP file involving some diagram creation, I can "kill" the machine if
I re-load the
script for five seconds continuously. It soaks up all my memory and runs for
nearly a minute multiple times. I've tried to limit that via php.ini's
memory limit setting and via Apache's RLimitCPU/RLimitNPROC/RLimitMEM
directive, but it does not seem to work.

Do you have any idea of what can be done in order to protect myself from
such an "attack"?

Thanks!
Florian

[cgiwrap-users] Newbie: cgiwrap on Debian - Migrating from Sun Cobalt

[Erwin v. d. H. <cgi...@ei...>]

Hi,

Hope someone can help me. I want to convert Sun Cobalt RAQ4 virtual hosts to
a Debian machine. The Sun uses cgiwrap for executing CGI scripts, Debian
standard suexec. I tried the stand Debian cgiwrap package, but didn't get it
working.

The results for a showuser.cgi script in the root of a site (not the user
home dir) are:

-- START CGI Script --
| #!/bin/sh
| echo "Content-type: text/plain"
| echo ""
| echo "Username="`whoami`
-- END CGI Script --

On the Sun I got the correct answer (the owner of the script), on the debian
I got the following error:

--- START Error ---
| CGIWrap was unable to find the user 'showuser.cgi' in the
| password file on this server.
--- END Error ---
So it took the scriptname as username

I copied the following configurations from the Sun srm.conf/httpd.conf into
the Debian httpd.conf:

-- START httpd.conf --
| ScriptAlias /cgiwrapDir/ /usr/lib/cgi-bin/
| Action cgi-wrapper /cgiwrapDir/cgiwrap
| Action cgi-wrapper-debug /cgiwrapDir/cgiwrapd
| <VirtualHost xx.xx.xx.xx:80>
|   DocumentRoot /home/sites/domain.nl/web
|   AddHandler cgi-wrapper-debug .cgi
|   AddHandler cgi-wrapper-debug .pl
| </VirtualHost>

-- END httpd.conf --

When configured with debug (cgiwrapd) I got the following results:

--- START cgiwrapd result ---
| Environment Variables:
|     QUERY_STRING: ''
|      SCRIPT_NAME: '/cgiwrapDir/cgiwrapd'
|  SCRIPT_FILENAME: '/usr/lib/cgi-bin/cgiwrapd'
|        PATH_INFO: '/showuser.cgi'
|  PATH_TRANSLATED: '/home/sites/domain.nl/web/showuser.cgi'
|      REMOTE_USER: '<NULL>'
|      REMOTE_HOST: '<NULL>'
|      REMOTE_ADDR: 'xx.xx.xx.xx'
|
| Trying to extract user from PATH_INFO.
| Retrieved User Name:  'showuser.cgi'
|
| etc....
--- END cgiwrapd result ---

On the cobalt the "Retrieved User Name" is empty, and the script continues
succesfull execution. Rest looks the same.
I did read the README.Debian with the standard Debian cgiwrap package, but
it seems to use some other configurator, when compiling the package
yourself.

Can someone give me some hints or give me the correct options when compiling
the cgiwrap sources myself.

Thanks in advance,
Erwin van der Horst

Re: [cgiwrap-users] Skript with root privileges??

[Elfriede H. <Elf...@ur...>]

Hello,
before posting my mail yesterday I changed the name of one 
variable. Unfortunately I didn't do this throughout the whole script. 
Sorry!
Here is the 'corrected' mail again.

The configuration of our cgiwrap-3.9 installation is:
  ./configure --with-perl=3D/usr/bin/perl  --with-httpd-user=3Dwww \
      -          --with-cgi-dir=3Dpublic_html/cgi-bin --with-wall \
                 --with-install-dir=3D/usr/local/apache/cgi-bin \
                 --with-check-shell  --with-minimum-uid=3D20 \
                 --without-redirect-stderr --without-logging-file \
                 --with-rlimit-core=3D0 --with-rlimit-cpu=3D30

 
 Calling following user=B4s HTML-Page, which contains PHP-lines:
 <html>
 <head>
 <title>owner.php</title>
 </head>
 <body>
 <?php
 $text           =3D "Hello";
 $datei          =3D "owner.txt";

 @unlink($datei);
 
 $fp             =3D fopen ($datei, "w");
 fwrite($fp,$text);
 fclose($fp);
 
 $fileowneruid   =3D fileowner($datei);
 
 $fileownerarray =3D posix_getpwuid($fileowneruid);
 $fileowner      =3D $fileownerarray['name'];
 
 echo "owner is $fileowner";
 ?>
 </body>
 </html>
 
 the output is:  owner is root
 and the file owner.txt doesn=B4t exist.
 If a file owner.txt existed before, even with UID root, it is deleted.
 I have to mention, that the owner of the HTML-Document isn=B4t root.
 It=B4s a user's document. However, the UID of the program cgiwrap
 is root.
 
 Changing the line
 $datei  =3D "owner.txt"   to
 $datei =3D "./owner.txt"
 the script works. That means the owner of the script is correct 
and the file owner.txt exists.
 
 What=B4s wrong?
We noticed this effect earlier with cgiwrap-3.7.1, so I installed 
cgiwrap-3.9. The OS is Solaris 8.
Adding --with-php=3D/usr/local/php/bin/php --with-php-interpreter
doesn't help either.

Thanks in advance for your help.

Yours,
Elfriede Heilmeier

Re: [cgiwrap-users] Skript with root privileges??

[Nathan N. <nn...@um...>]

On Thu, Mar 04, 2004 at 10:43:41AM +0100, Elfriede Heilmeier wrote:
> Hello,
> the configuration of our cgiwrap-3.9 installation is:
> ./configure --with-perl=3D/usr/bin/perl  --with-httpd-user=3Dwww \
>                 --with-cgi-dir=3Dpublic_html/cgi-bin --with-wall \
>                 --with-install-dir=3D/usr/local/apache/cgi-bin \
>                 --with-check-shell  --with-minimum-uid=3D20 \
>                 --without-redirect-stderr --without-logging-file \
>                 --with-rlimit-core=3D0 --with-rlimit-cpu=3D30
>=20
>=20
> Calling following user=B4s HTML-Page, which contains PHP-lines:
> <html>
> <head>
> <title>owner.php</title>
> </head>
> <body>
> <?php
> $text           =3D "Hello";
> $datei          =3D "owner.txt";
>=20
> @unlink($datei);
>=20
> $fp             =3D fopen ($textfile, "w");

What is $textfile?

> fwrite($fp,$text);
> fclose($fp);
>=20
> $fileowneruid   =3D fileowner($textfile);

> $fileownerarray =3D posix_getpwuid($fileowneruid);
> $fileowner      =3D $fileownerarray['name'];
>=20
> echo "owner is $fileowner";
> ?>
> </body>
> </html>
>=20
> the output is:owner is root
> and the file owner.txt doesn=B4t exist.
> If a file owner.txt existed before, even with ownership root, it had
> been deleted.
> I have to mention, that the owner of the HTML-Document isn=B4t root.
> It=B4s a user's document. However, the owner of the program cgiwrap
> is root.
>=20
> Changing the line
> $datei  =3D "owner.txt"   to
> $datei =3D "./owner.txt"
> the skript works correct.
>=20
> What=B4s wrong?
>=20
> Yours,
> Elfriede Heilmeier
>=20
>=20
> -------------------------------------------------------
> This SF.Net email is sponsored by: IBM Linux Tutorials
> Free Linux tutorial presented by Daniel Robbins, President and CEO of
> GenToo technologies. Learn everything from fundamentals to system
> administration.http://ads.osdn.com/?ad_id=1470&alloc_id638&op=3Dclick
> _______________________________________________
> cgiwrap-users mailing list
> cgi...@li...
> https://lists.sourceforge.net/lists/listinfo/cgiwrap-users

------------------------------------------------------------
Nathan Neulinger                       EMail:  nn...@um...
University of Missouri - Rolla         Phone: (573) 341-4841
UMR Information Technology             Fax: (573) 341-4216

[cgiwrap-users] Skript with root privileges??

[Elfriede H. <Elf...@ur...>]

Hello,
the configuration of our cgiwrap-3.9 installation is:
./configure --with-perl=3D/usr/bin/perl  --with-httpd-user=3Dwww \
                --with-cgi-dir=3Dpublic_html/cgi-bin --with-wall \
                --with-install-dir=3D/usr/local/apache/cgi-bin \
                --with-check-shell  --with-minimum-uid=3D20 \
                --without-redirect-stderr --without-logging-file \
                --with-rlimit-core=3D0 --with-rlimit-cpu=3D30


Calling following user=B4s HTML-Page, which contains PHP-lines:
<html>
<head>
<title>owner.php</title>
</head>
<body>
<?php
$text           =3D "Hello";
$datei          =3D "owner.txt";

@unlink($datei);

$fp             =3D fopen ($textfile, "w");
fwrite($fp,$text);
fclose($fp);

$fileowneruid   =3D fileowner($textfile);
$fileownerarray =3D posix_getpwuid($fileowneruid);
$fileowner      =3D $fileownerarray['name'];

echo "owner is $fileowner";
?>
</body>
</html>

the output is:owner is root 
and the file owner.txt doesn=B4t exist.
If a file owner.txt existed before, even with ownership root, it had 
been deleted.
I have to mention, that the owner of the HTML-Document isn=B4t root. 
It=B4s a user's document. However, the owner of the program cgiwrap 
is root.

Changing the line 
$datei  =3D "owner.txt"   to 
$datei =3D "./owner.txt"
the skript works correct.

What=B4s wrong?

Yours,
Elfriede Heilmeier

[cgiwrap-users] Installing cgiwrap 3.8 on -Mac OS X 10.3.2 with -Apache 1.3.29 -Movable Type 2.661 -PHP 4.3.4

[MacMatrix <mac...@ma...>]

Well this is my first cry for help.

I think I'm in neck deep!

Before installing cgiwrap I had the following up ad running.

#1 - I got Apache up and running with default config.

#2 - I got PHP up and running by following this How to by
       Marc Liyanage at http://www.entropy.ch/software/macosx/php/

#3 - I got Movable Type running with the help of this how to
       http://lawver.net/geek/geeked/002212.php and from the MT 
documentation.


Then in installed cgiwrap using this how to by Ryan Wilcox at
http://www.wilcoxd.com/blog/archives/000036.html with this config

./configure --with-vhost-override 
--with-cgi-dir=/Library/WebServer/CGI-Executables/ 
--with-httpd-user=www 
--with-install-dir=/Library/WebServer/CGI-Executables

Now when I try to execute mt-check.cgi I get this error.
==================================================================
Initializing Logging
Redirecting STDERR to STDOUT


Environment Variables:
      QUERY_STRING: ''
       SCRIPT_NAME: '/cgi-bin/cgiwrapd'
   SCRIPT_FILENAME: '/Library/WebServer/CGI-Executables/cgiwrapd'
      REDIRECT_URL: '/cgi-bin/mt/mt-check.cgi'
         PATH_INFO: '/cgi-bin/mt/mt-check.cgi'
   PATH_TRANSLATED: '/Library/WebServer/CGI-Executables/mt/mt-check.cgi'
       REMOTE_USER: '<NULL>'
       REMOTE_HOST: '<NULL>'
       REMOTE_ADDR: '127.0.0.1'


Trying to extract user from PATH_INFO.
Retrieved User Name:  'cgi-bin'

*****************
* CGIWrap Error *
*****************

CGIWrap was unable to find the user 'cgi-bin' in the
password file on this server.

Check the URL and try again.
=================================================================


I noticed the " CGIWrap was unable to find the user 'cgi-bin' in the 
password file on this server.".
Where did it get cgi-bin as a user?
Where do I change this?
What am I missing?

If more config info is needed let me know.

Thanks in advance for your help.

[cgiwrap-users] Issue with compiled Perl

[<wa...@pi...>]

Greetings;

I have a customer with a compiled perl  application using Perl2exe.
The program binary works fine under Suexec and directly running as the 
"httpd" user.

However under cgiwrap it crashes and we see the following error in cgiwrapd.

It appears as if CGI wrap is feeding the binary to the perl program yet 
we do
not have the --with-perl option compiled in.

Note some small programs using the same compiler
seem to work fine under cgiwrap.

We are using cgiwrap 3.9 configured thusly

./configure \
--with-require-redirect-url \
--with-cgi-dir="public_html" \
--with-httpd-user=httpd \
--with-minimum-gid=500 \
--with-minimum-uid=500 \
--with-logging-file=/var/log/httpd/cgiwrap.log

and using the AddHandler - Action method to call the cgiwrap from
Apache 2.0/Linux  The INSTALLED perl on the sytem is 5.8 but the program
was compiled under 5.6.1 (but as I mentioned above it runs fine directly).

CGIWRAPD output

Output of script follows:
=====================================================
Bareword found where operator expected at - line 1, near "3B"
   (Missing operator before B?)
Operator or semicolon missing before &Item_Name at - line 1.
Ambiguous use of & resolved as operator & at - line 1.
Bareword found where operator expected at - line 1, near "3B"
   (Missing operator before B?)
Operator or semicolon missing before &Item_Price at - line 1.
Ambiguous use of & resolved as operator & at - line 1.
Operator or semicolon missing before &Item_Weight at - line 1.
Ambiguous use of & resolved as operator & at - line 1.
Operator or semicolon missing before &Item_Description at - line 1.
Ambiguous use of & resolved as operator & at - line 1.
Operator or semicolon missing before &Item_Qty at - line 1.
Ambiguous use of & resolved as operator & at - line 1.
Operator or semicolon missing before &add_to_cart_button at - line 1.
Ambiguous use of & resolved as operator & at - line 1.
Operator or semicolon missing before &add_to_cart_button at - line 1.
Ambiguous use of & resolved as operator & at - line 1.
syntax error at - line 1, near "3B"
Transliteration pattern not terminated at - line 1.
Error: Can't open source file

[cgiwrap-users] Patch to v3.9

[David A. G. <ger...@et...>]

Hello All,

   I tweaked the "util.c" code a bit for some functionality I needed and 
thought I'd pass the info (and patch) on to you all.

Short Background:
   I have a web mail tool I wanted run as the individual user.  However, 
I did not want the user to have cgi execution privileges except for just 
the mail tool.  The MultiUser CGI Directory feature wouldn't work since 
it searches the Multi User directory only if the script can not be found 
under the user's base directory...i.e. their home directory.
   Since the user has full control over their home directory, the answer 
was to place the scripts outside in a common area where the user only 
has read and execute permissions.  With CGIWrap compiled to treat that 
one directory as the user's base directory, the user has cgi execution 
privileges, but not to any directory where they can create/modify files.

The attached patch adds an 'if' branch to "GetBaseDirectory".  If the 
config file specifies a "CONF_SINGLE_CGIDIR", that is used as the base 
directory instead of the user's home directory obtained from the passwd 
file.

To use the patch:

- Extract cgiwrap-3.9.tar.gz as usual
- Apply the patch:  patch < util.patch
- Configure as you normall would but use --with-cgi-dir=/
   (This will keep the "relative" path within the single cgidir we will
     specify in a minute).
- Edit config.h and add:
     #define CONF_SINGLE_CGIDIR "/path/to/cgis"
- continue as normal.

I'm not familiar with 'configure.in' so I didn't want to mess it up
with a patch.  If someone is willing to generate a comprehensive patch 
so that the CONF_SINGLE_CGIDIR can be set at configure time...that'd be 
cool (i.e.  ./configure --with-single-cgidir=/path/to/cgis ...)

Any comments/feedback are welcome...

David

Re: [cgiwrap-users] REMOTE_USER

[Peter K. <pe...@li...>]

YOu wouldn't know if someone has already done a serious one of these?

Anyway thanks for the reply - I guess as apache moves forward it will 
eventually have  (ssl as secure as ssh2) login and permissions access based 
on system file permissions.

This on top of the current explicitly authorized "virtual tree".
It would be nice :)


At 09:10 2/15/2004 -0600, Nathan Neulinger wrote:
>No... really isn't designed to do that... Best bet there would be
>a specifically written wrapper script that would check REMOTE_USER and
>only run specifically compiled-in scripts, made setuid.
>
>-- Nathan
>
>On Sun, Feb 15, 2004 at 02:59:16AM -0500, Peter Kennard wrote:
> >
> > On apache-ssl I want a number of cgi scripts like cvsweb etc to run as the
> > logged in user (REMOTE_USER) but out of a global cgi-bin directory rather
> > than the user's home directory.  I keep REMOTE_USER from the https login
> > synchronized with the unix login, and then let unix access permissions
> > allow or deny them access to whatever - easier to keep track of that
> > way.  I couldn't find anything about this.  I do not allow any non https
> > logins to do this.
> >
> > can cgiwrap be configured to do this?
> > I am running a Debian server.
> >
> > Thanks!
> >
> > Peter K.
> >
> >
> >
> > -------------------------------------------------------
> > SF.Net is sponsored by: Speed Start Your Linux Apps Now.
> > Build and deploy apps & Web services for Linux with
> > a free DVD software kit from IBM. Click Now!
> > http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
> > _______________________________________________
> > cgiwrap-users mailing list
> > cgi...@li...
> > https://lists.sourceforge.net/lists/listinfo/cgiwrap-users
>
>------------------------------------------------------------
>Nathan Neulinger                       EMail:  nn...@um...
>University of Missouri - Rolla         Phone: (573) 341-4841
>UMR Information Technology             Fax: (573) 341-4216
>
>
>-------------------------------------------------------
>SF.Net is sponsored by: Speed Start Your Linux Apps Now.
>Build and deploy apps & Web services for Linux with
>a free DVD software kit from IBM. Click Now!
>http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
>_______________________________________________
>cgiwrap-users mailing list
>cgi...@li...
>https://lists.sourceforge.net/lists/listinfo/cgiwrap-users