1

problem "solved"? after backtracking where the permission first stops, the permission denial suddenly went away for no reason.

I am building a webpage where the user must have the possibility to send an input choosing certain predefined names in a local database. (the user-input is either a html form or imported .txt file)

From php i want to be able to call python scripts that further gets other information from the db. With that information i need to be able to create files that is going to be sent back to the user

how can i make my script calls without opening security holes to the user, how do i configure my apache?

i use apache 2.2.3 as webserver

Right now i have problems with permissions from apache when i try to write to a file from my python script? Permission to write is denied even if i give script, textfile and directories full permission (777) apache itself must have some security config that disallow the web user to write?

Traceback (most recent call last):
  File "python/pythonscript.py", line 6, in ?
    f = open("/var/www/(path)/textfile.txt", "w")
IOError: [Errno 13] Permission denied: '/var/www/(path)/textfile.txt'

Can i configure my webserver to allow scripts to read and write to files locally but not allowing the web users to have that power? If so what is the most secure way to do it?

Improve this question

2 Answers 2

Reset to default
1

Well; I am no expert on this but observe that your question:

Can i configure my webserver to allow the server to run scripts and write to files locally but not allowing users to have that power

Is quite misleading - by default all actions performed on your computer will be done by the webserver, on behalf of the user. There is no user concept for the remote users accessing your webpage, whatever they do will be as the user running the webserver.

When have succesfully started your Python script the concept of web-server configuration no longer applies; now you are just running any Python script (typically as the user www-data) and normal access rules apply. For the script in question to be able to write to a file, the user running the web-server must have write acess to the directory in question.

I would strongly recommend writing to another location than /var/www, e.g. /tmp. You might need to limit the size of files written? Be certain to only read (and write) the bytes you upload, and not try to execute anything of it.

Improve this answer
2
  • I have updated the question a bit. Thanks for the advices but I still don´t know and understand how to configure my apache (config) to allow me to write to a certain directory? Right now access is permission to write is denied even if i give script, textfile and directories full permission (777)
    – David S
    Commented Apr 19, 2011 at 9:56
  • As mentioned already as long as apache has succesfully started your script this is no longer a apache configuration question (I think...). To help in the debugging you could login as the user running apache (www-data ??) and run the script manually from the command line.
    – Anonymous
    Commented Apr 19, 2011 at 10:49
0

The key is to sanitize user input -- there is not need to do any special configuring other than making the scripts executable. The user can only perform the actions your code performs, and you control exactly what your code does. There's no silver bullet to ensuring security. There are a few very important things to look out for:

  • Be absolutely sure that the user has no way of influencing the paths of scripts/files executed/read. For example, f=open("/tmp/myfiles/"+some_path_from_user,"w") would be VERY BAD and allow the user to write any file he wanted to (that apache has permissions for)

  • This applies double when executing scripts. All the paths to scripts should be pre-defined if possible and the user should not be able to modify these scripts.

  • Keep your scripts separate from your other files.

  • Use principle of least privilege when setting permissions on files/scripts.

Improve this answer
2
  • So for example if i write a file with my python script i can put it in /root/home/somedirectory and not var/www, but how do i add permissions from apache to a local directory, it must be apache that limits my permission when the unix chmod is set to 777 and i still cant write to the directory!?
    – David S
    Commented Apr 19, 2011 at 10:22
  • You should NEVER set a folder world-writable (especially not if it's accessible from your webserver as seems to be the case in your example). If you set the permissions to 777 and you still can't write to the folder then it could be that you have SELinux or AppArmor (or a similar MAC solution) running that has some policies defined that prevent you from being able to write to specific folders. If that's the case, then changing the policies in use should solve the problem (but that's a discussion that belongs on ServerFault, not here).
    – wimvds
    Commented Apr 19, 2011 at 12:55

You must log in to answer this question.