Apache's Security Precautions (Apache: The Definitive Guide)

13.2. Apache's Security Precautions

Apache addresses these problems as follows:

When Apache starts, it connects to the network and creates numerous copies of itself. These copies immediately change identity to that of a safer user, in the case of our examples, the feeble webusers of webgroup (see Chapter 2, "Our First Web Site"). Only the original process retains the superuser identity, but only the new processes service network requests. The original process never handles the network; it simply oversees the operation of the child processes, starting new ones as needed and killing off excess ones as network load decreases.
Output to shells is carefully tested for dangerous characters, but this only half solves the problem. The writers of CGI scripts (see Chapter 4, "Common Gateway Interface (CGI) ") must be careful to avoid the pitfalls too. The foregoing represents the official Apache line. However, the whole scheme was inherited from NCSA, and, in our opinion, is completely misguided. The problem is that the dangerous characters are protected by backslashes, which, of course, disappear once they have been interpreted by the shell. If that shell then calls another one and passes them on, their dangerous behavior reappears.

Internal users present their own problems, the main one being that they want to write CGI scripts to go with their pages. In a typical installation, the client, dressed as Apache (webuser of webgroup) does not have high enough permissions to run those scripts in any useful way. This can be solved with suEXEC (see the section Section 4.7, "suEXEC on Unix" in Chapter 4, "Common Gateway Interface (CGI) ").