Re: [htdig] keeping include: from overriding directives in the config

[JupiterHost.Net <mlists@ju...>]

Neal Richter wrote:
>  If you are dilligent enough in verifying input from the user you can 
> lock-down what the user could enter to the file.  You could also have a 
> process to copy the user/PHP created script to the main htdig.conf file 
> to further isolate it.

Put PHP's security problems aside, if the file is owned by the user or 
nobody (IE the script can write to it) then the user can open it in a 
text editor via SSH and change it, so all the hours you'd spend 
limiting, checking and hoping you didn't miss any sort of "bad entry" 
injection, is all for naught because they have write access to it.

> I understand your idea.  It's a good idea.  I am trying to come up with 
> a work-alike for you, as it's unlikely that the idea will be implemented 
> in 3.1.6 or 3.2.bx.

I don't need an interface to edit a config file (which in itself isn't a 
bad idea and has been done) I needed to know for sure if:

include: file/they/can/write/to/by/whatever/means.conf
important: they should not be able to change this via their include

then they can put whatver they want in 
file/they/can/write/to/by/whatever/means.conf and "important" will 
always be "they should not be able to change this via their include"

> The other alternative is to set up the defaults.cc file how you want it 
> and make a custom binary, then the htdig.conf file would only contain 
> the user overrides you allow.  A perl script could validate that only a 
> discrete set of configs are contained in the file and filter-out others 
> before passing to htsearch via a command-line switch.   htdig -c xxx.conf.

To much work and ways to get around it still :), just:

include: file/they/have/write/access/to.conf
# directives you don't want chanegd here

then you're directives are "safe" and there's zero overhead mainteneance 
wise because only I can write to the file described above.

What *would* be a nice addition to htdig is to make it catch include: loops:

in main.conf
    include: user.conf

in user.conf
    include: main.conf

it'd include user.conf and when it got to the include: user.conf line 
throw a warning/log that main.conf is already part of the party and then 
ignore it.

That'd be trivial to do and would be extremely handy :)

Thanks for the input though

Re: [htdig] keeping include: from overriding directives in the config

[JupiterHost.Net <mlists@ju...>]

Kurt Cypher wrote:

> JupiterHost.Net wrote:
> 
>> Excellent! Exactly what I'd been looking for :) although that text 
>> isn't at that url for me, weird??
>>
> I should have mentioned that once you click on 
> <http://www.htdig.org/confindex.html>;, then you click on "Alphabetical" 
> over on the left-hand side, under "Attributes", then scroll down and 
> click on "include".

No worries, I should've used a bit of common sense to figure out where 
include was documented :)

Have a great day Kurt

Re: [htdig] keeping include: from overriding directives in the config

[Kurt Cypher <kurt.cypher@wr...>]

JupiterHost.Net wrote:
> Excellent! Exactly what I'd been looking for :) although that text isn't 
> at that url for me, weird??
> 
I should have mentioned that once you click on 
<http://www.htdig.org/confindex.html>;, then you click on "Alphabetical" 
over on the left-hand side, under "Attributes", then scroll down and 
click on "include".

>> This paragraph does bring up the interesting point of what could 
>> happen if the user adds an include that references the main config file:
>>
>> common.conf -> include: user.conf
>> user.conf -> include: common.conf
>>
>> I don't know exactly how that would manifest itself, but I imagine it 
>> wouldn't be a good thing.
> 
> 
> Good point, I'll have to consider that as well. At least a big fiery 
> warning that says:
>  You will 100% guaranteed break your config if you include: the 
> configuration file that uses this file.
> 
> Thanks again Kurt!
> 

You're welcome.

Kurt

Re: [htdig] keeping include: from overriding directives in the config

[JupiterHost.Net <mlists@ju...>]

>> b) if htdig uses the last instance of it then I need to specify it last
>> to override anything they put in:
>>
>>   include: their/file
>>   whatever: they shouldn't be able to change this
>>
>> Which way would make it so that even if they specified "whatever:" it 
>> woudl still use the "whatever:" in the main config that they do not 
>> have access to?
>>
>>
> 
>  From the definition of "include" at <http://www.htdig.org/confindex.html>;
> 
> "The last definition of an attribute is the one that applies, so after 
> including a file, any of its definitions can be overridden with 
> subsequent definitions. This can be useful when setting up many 
> configurations that are mostly the same, so all the common attributes 
> can be maintained in a single configuration file. The include directives 
> can be nested, but watch out for nesting loops."
> 
> So, according to that, anything you do not want the user to be able to 
> change would need to be after the include statement, which would be 
> option "B" above.

Excellent! Exactly what I'd been looking for :) although that text isn't 
at that url for me, weird??

> This paragraph does bring up the interesting point of what could happen 
> if the user adds an include that references the main config file:
> 
> common.conf -> include: user.conf
> user.conf -> include: common.conf
> 
> I don't know exactly how that would manifest itself, but I imagine it 
> wouldn't be a good thing.

Good point, I'll have to consider that as well. At least a big fiery 
warning that says:
  You will 100% guaranteed break your config if you include: the 
configuration file that uses this file.

Thanks again Kurt!

Re: [htdig] keeping include: from overriding directives in the config

[Kurt Cypher <kurt.cypher@wr...>]

JupiterHost.Net wrote:
> 
> No need for any sort of special editor or interface, just in the config 
> file they do not have write access to does it need to be A or B:
> 
> a) if htdig uses the first instance of it then I need to specify it first:
> 
>   whatever: they shouldn't be able to change this
>   include: their/file
> 
> 
> b) if htdig uses the last instance of it then I need to specify it last
> to override anything they put in:
> 
>   include: their/file
>   whatever: they shouldn't be able to change this
> 
> Which way would make it so that even if they specified "whatever:" it 
> woudl still use the "whatever:" in the main config that they do not have 
> access to?
> 
> 

 From the definition of "include" at <http://www.htdig.org/confindex.html>;

"The last definition of an attribute is the one that applies, so after 
including a file, any of its definitions can be overridden with 
subsequent definitions. This can be useful when setting up many 
configurations that are mostly the same, so all the common attributes 
can be maintained in a single configuration file. The include directives 
can be nested, but watch out for nesting loops."

So, according to that, anything you do not want the user to be able to 
change would need to be after the include statement, which would be 
option "B" above.

This paragraph does bring up the interesting point of what could happen 
if the user adds an include that references the main config file:

common.conf -> include: user.conf
user.conf -> include: common.conf

I don't know exactly how that would manifest itself, but I imagine it 
wouldn't be a good thing.

Kurt

Re: [htdig] Moving ht://Dig

[Victor Roman <roman_v@ro...>]

Thanks Mike, I appreciate the response. I also have the problem of not being
able to compile on a public system. Mine is a 'smaller' problem with Linux
to Linux and just making sure the libraries are compatible. This seems to be
possible only if the libraries are identical - my environment is (kernel
2.4, GCC 3.3.2).

Victor

----- Original Message ----- 
From: "Mike Causer" <mikec@...>
To: "Victor Roman" <roman_v@...>
Cc: <htdig-general@...>
Sent: Monday, December 05, 2005 8:19 PM
Subject: Re: [htdig] Moving ht://Dig


> On Thu, 1 Dec 2005 11:19:47 -0500 "Victor Roman" <roman_v@...>
wrote:
>
> > Is it possible to move ht://Dig to another server with just path
> > adjustments and without reinstallation?
>
> Yes.  I build the db on one Linux distro and run the public version on
> another.  I cannot compile on the public system, nor install rpms, so I
> have to disassemble an rpm for the target system and copy over the
> binaries.
>
> To avoid potential snafus I keep the htdig directory structure of my
> home machine as close as possible to the target system, so that there
> are only two lines in the config file to be commented out between the
> systems.
>
> I'm confident this could be made to work between Linux and Solaris, and
> probably HPUX/AIX etc.  The more Unices you've wrestled with the easier
> it gets (and the more grey hair you have -- but they're ALL better than
> wrangling JCL on a CDC6600!).
>
>
> Your question is a little light on detail, so it may be that you have a
> smaller problem than I think, eg between two RedHat servers, or maybe a
> bigger problem that I think eg Solaris to W2K.   A bit more description
> of your circumstances would get a better answer.
>
>
> Mike
> -- 
> Mike Causer                          Email - mailto:mikec@...
> GPG KeyID 1C2DDA07                       WWW - http://www.mikecauser.com
> Flood the fen again! - Wicken Fen enlargement - http://www.wicken.org.uk
>