MOD_DIFFPRIVS
A p a c h e S e c u r i t y M o d u l e
Make Apache configurable to work with diffrent uid/gid and chroot environment for each <VirtualServer>. Distributed under GNU General Public License.
Author: Lukasz Wojtow <
lw@ftw.zamosc.pl>
Require: Apache httpd 1.3.x (it doesn't work for 2.0 yet)
Interesting ideas: Rafal Wijata <
www.wijata.com>
Latest version available at:
http://sourceforge.net/projects/moddiffprivs/ and
http://lw.ftw.zamosc.pl/mdp
This module provides three configuration directives:
- "Privs",
- "PrivsGroups",
- "PrivsUser"
- "PrivsAllowJumpVisits" - obsoleted, now always Off
All directives may be used in main server configuration or/and in
<VirtualServer> section.
[...]
2. PrivsGroups
When You use directive Privs for some server and want to change gid, then probably setgid() leaves groups[0] to old gid. This is bad for security reasons, beacuse when You want change only gid (as me), then changes are don't take effect. Normally processes have to call setgroups(0,NULL) to clear their groups table. This is done by this directive, it takes "Leave", "Clear" or "Init". If set to Leave - apache does nothing (leaves its groups[]). If set to Clear - apache clears any of supplementary groups. And finally if set to Init - apache will init user's groups to its groups, just as 'su' does. The default for now if Leave. Remember about some security consequences: sometimes You add some user to some group to _remove_ acces for this user (ie when file perms are:
rw----rw-, then group can't read this file). If user may call setgroups(0,NULL) then after that he/she is able to read such file.
3. PrivsUser
This directive is almost the same as Privs but it affects requests for ~user files. If you don't use it - then such requests will be disallowed for this server. This directive get 3 parameters: uid gid chrootdir. Uid and Gid can be #number or name (as in Privs directive) but can be also AsUserUid and AsUserGid. If AsUser* is used, bot gid and uid must me set to AsUser*. In this case, module will get username from ~user/file.html request and will do setgid() and setuid() for this user gid/uid (but still uid and gid cannot be less than MIN_GID and MIN_UID). Third parameter is dir (as in Privs) but can be also "AsUserHome", then module will get user (from ~user/file.html request) home dir, and call chroot for this dir. You can also do chroot for dir relative to user's home, ie AsUserHome.. or AsUserHome../../some_dir (and similar) In dir where chroot will be called, /etc/passwd have to exist, and there user's home dir have to be without chrootdir, ie:
in /etc/passwd is:
lw
1000
Lukasz W:/home/lw:/bin/bash
You want call chroot for /home for all user's requests, and setuid for user uid, setgid for user gid.
In httpd.conf:
PrivsUser AsUserUid AsUserGid AsUserHome..
You have to create file /home/etc/passwd and there:
lw
1000
Lukasz W:/lw:/bin/bash
^^^^
One more thing. If uid & gid is set to AsUser* and real dir is given (not AsUserHome), then module will try find user in /etc/passwd. But if it fails, it will try find user again after chroot is done.
If You have any problems, use DEBUG (define
ISDEBUG 1 in config.h) or use strace.
[...]
Mod_diffprivs has not defined 'merge' function, so directives from main server
are NOT inherited by virtual servers. This mean, if You set whatever directive in main server, it won't take effect in virtual servers. If You want it in virtual servers, You have to set it there explicit. Also, when You use this module, You have to change "MaxRequestPerChild" to 1. For ~User requests You have to set KeepAlive to Off. This may decrase Your Apache performance, so better increase "StartServers", "MinSpareServers" and "MaxSpareServers" something about 40% of current values. This module require from Apache some root's privileges. If You don't want run Apache as root and You are using Linux 2.2.x or 2.4.x, You can use tool "erup" by Rafal Wijata.
Erup allow You to set some users who can do setuid/setgid for other users,
and users who can call chroot for some dirs.
[...]