Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

340

|

Chapter 10: Securing Web Servers

We’ll see that taint mode applies to file I/O, program execution, and other areas

where Perl is reaching out into the world.

Including Files

CGI scripts can include files inside or outside of the document hierarchy. Try to

move sensitive information from your scripts to files located outside the document

hierarchy. This is one layer of protection if your CGI script somehow loses its protec-

tive cloak and can be viewed as a simple file.

Use a special suffix for sensitive include files (a common choice is .inc), and tell

Apache not to serve files with that suffix. This will protect you when you acciden-

tally put an include file somewhere in the document root. Add this to an Apache

configuration file:

<FilesMatch "\.inc$">

order allow,deny

deny from all

</Files>

Also, watch out for text editors that may leave copies of edited scripts with suffixes

like ~ or .bak. The crafty snoop could just ask your web server for files like program~

or program.bak. Your access and error logs will show if anyone has tried. To forbid

serving them anywhere, add this to your Apache configuration file:

<FilesMatch ~ "(~|\.bak)$">

order allow,deny

deny from all

</Files>

When users are allowed to view or download files based on a submitted form vari-

able, guard against attempts ...