Mailing-List: contact new-httpd-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: new-httpd@apache.org
From: "Daniel Quellhorst" <dan@quecom.com>
To: <new-httpd@apache.org>
Subject: Question about Apache Security on virtual hosting
Date: Thu, 14 Dec 2000 21:35:33 -0600
Message-ID: <LPBBIPIOBCCICHCLEPBLEEPCCHAA.dan@quecom.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Importance: Normal

Hello,

I have noticed on most all shared virtual hosting companies that run apache,
any user with an account can go in and read the source code to the other
people's scripts.

This means that database user name and passwords can be read. Even on
e-commerce hosting companies this is largely the case. I know that you can
set a user directive inside of virtual hosts but that only works with cgi
scripts.

Is there a way in apache 1.3, other than making separate running copies of
apache for each user, to have all requests CGI and Non-CGI to be done by a
different user for every virtual host.

I also do Host: based virtual hosting, so separate instances are really not
possible. If I compile php as a cgi, I then also have the issue of ssi
scripts doing includes inside of other people's directories.

Will Apache 2.0 solve this? I currently have the latest cvs dump of apache
2.0 running on my machine for testing. If there is a way to solve this issue
with 2.0 I would love to know how.

I would really value any input that you have.

Thanks,
Dan