Perl for Web Site Management

Guestbook File Permissions

Any time we want a CGI script to write to a file on the web server, we have some security-related issues to consider. Because the CGI script typically runs as nobody or www or some other unprivileged user, it can’t normally make changes to a file owned by some other user (like our own user account, the one we’ve used for setting up the guestbook). There are at least three alternatives for solving this problem.

One solution is to have the guestbook file be owned by the same user as the web server process: nobody or www or whatever it is in this particular case.

If we have access to a helpful system administrator we could have him do this for us. Or we could make the directory in which the data file is going to be created world-writeable (using chmod to set its permissions to 777), then run a special CGI script to create the guestbook file. After that we would reset the directory’s permissions to something more reasonable, like 755, which will still allow the guestbook script to add entries to the data file, but will prevent everyone else in the world from creating new files in the directory.

One problem with this approach is that it makes it harder for us to edit the guestbook file manually. We might want to add a reply to one of the guestbook entries, for example, or delete a specific entry. If the guestbook file is owned by the same account as the web server and isn’t world-writeable, we won’t be able to make changes to it easily.

Another approach ...