5 ms·

I used that all the time back in school. You'd often recognize the names that turned up, students in the same course, TAs, etc. Occasionally you'd get stuff l

I used that all the time back in school. You'd often recognize the names that turned up, students in the same course, TAs, etc. Occasionally you'd get stuff like this: jsmith - - - emacs cs350/assignment3.c and it was hard to resist the urge to take a peek at what jsmith was working on. Practically no one bothered to set proper file permissions, leaving their files readable to anyone who knew how to find them.

ajasmin 15y ago
no one bothered to set proper file permissions That's why shared hosting accounts are so bad. The Unix security model isn't designed for hosting a bunch of unrelated websites on the same box. Why should I even be allowed to make a file world readable or run the w command on a web host on which the users don't even know each other? People should really be using VPS now that they are so cheap. Edit: After reading the answer to this comment it seems my fear of shared hosting may not be justified. Obviously good sysadmins know how to properly secure these systems. Still it seems that when Unix was designed it was expected that people would chat with the talk command, see who was online with the who command, and intentionally make files readable by other. With web hosting you really don't want that. You shouldn't even be able to see what other accounts there are on the machine. I was probably wrong to say that shared hosting accounts are "bad" but it doesn't seem like a perfect fit either.
- mike-cardwell 15y ago
  I built a shared hosting platform on Linux once. The "home" directories for each user were owned by the Apache user, and readable by the user the site ran as. IIRC, something like this: drwxr-x--- and "www-data:mike" The htdocs directory inside was writeable only by the "mike" user in this case. Of course, all cgi/php ran as the user account, rather than as the Apache user. So even if the user screwed up the permissions and created globally read/write files, there was no way that any other user could access them.
- soult 15y ago
  The Unix security model is designed for mutli-user hosts. Shared hosting works very well under Unix, iff the admins know what they are doing. Why do you think that before virtualization got popular people were using shell accounts, chroots and BSD Jails for their webhosting/IRC/... needs? Why do you think we have CGI, SuExec, ...? I won't deny that VPS are great, but a properly set up shell server will allow you to do many of the same things a VPS can do.
  - zokier 15y ago
    > The Unix security model is designed for mutli-user hosts. Reminds me of the story of RMS complaing about evil admins that were restricting root level access. The views on computer users and security were quite different in the early days of UNIX. edit: link http://news.ycombinator.com/item?id=2518881 http://news.ycombinator.com/item?id=2518881
    - gaius 15y ago
      RMS' views might have been different. In a little thing we call actual reality the sysadmin is an employee hired by the same people who bought the system (no small investment in those days) to maintain it, and I don't think any reasonable person has ever denied that.
- zokier 15y ago
  The shared hosting I'm using has restricted access for users above certain UID to other peoples home directories, regardless of the permission bits.
hkolk 15y ago
I had to inform a professor he was running an open home directory like that. Pretty tricky to do as it implies you were looking for it in the first place.
- ryanbraganza 15y ago
  How did you do it?
- Roritharr 15y ago
  I learned my lesson about never talking about the security flaws i found in school. Our web access went over secured proxy servers, which determined via our windows login which services to allow or disallow us. As our deputy rector considered himself an open IT advocate, he ensured all browsers we're installed on all machines, including Opera. Back then Opera couldn't use the Windows login to auth with the proxy server, which he "fixed" by using a pre-configured user which just had student rights. As i'd never use opera i didn't notice it until one of my teachers tried to block me from using any webmail client as a way to transfer files to the school pc. Trying different things i got the tip from a classmate to start opera. I was struck by a preentered login box which i was told to just hit ok. I got curious and inspected the fields. The loginname had admin in it, so i thought the password might be used elsewhere... Well, i've seen our deputy rector on our central win 2003 server via windows remote desktop before, so i connected to it, using the user and pass from opera and logged in to an open session on the server which stored all critical school data, including grades of all students attending that school and the transfer tool to send the grades to the statewide server which would make the grades final. As it was so ridiculously easy i got scared that someone from my class would do the same and then get into deeper trouble for actually trying to change grades or something, i immediately went to our deputy rector and told him all about it. He banned me from using school pc's for the rest of the year and afterwards all teachers were told to keep their eyes on what i was doing on the school pcs...
  - zdw 15y ago
    Imagine if you had just changed the background picture on the server you accessed to a lolcat or something funny, and left a short text file how you got in, saying that you didn't change anything. Even better would be to change the password, then leave him an anonymous typed note with it, which would prevent others from abusing the system. True anonymous reporting is almost as good as whistleblower protection.

ajasmin 15y ago

no one bothered to set proper file permissions That's why shared hosting accounts are so bad. The Unix security model isn't designed for hosting a bunch of unrelated websites on the same box. Why should I even be allowed to make a file world readable or run the w command on a web host on which the users don't even know each other? People should really be using VPS now that they are so cheap. Edit: After reading the answer to this comment it seems my fear of shared hosting may not be justified. Obviously good sysadmins know how to properly secure these systems. Still it seems that when Unix was designed it was expected that people would chat with the talk command, see who was online with the who command, and intentionally make files readable by other. With web hosting you really don't want that. You shouldn't even be able to see what other accounts there are on the machine. I was probably wrong to say that shared hosting accounts are "bad" but it doesn't seem like a perfect fit either.

mike-cardwell 15y ago
I built a shared hosting platform on Linux once. The "home" directories for each user were owned by the Apache user, and readable by the user the site ran as. IIRC, something like this: drwxr-x--- and "www-data:mike" The htdocs directory inside was writeable only by the "mike" user in this case. Of course, all cgi/php ran as the user account, rather than as the Apache user. So even if the user screwed up the permissions and created globally read/write files, there was no way that any other user could access them.
soult 15y ago
The Unix security model is designed for mutli-user hosts. Shared hosting works very well under Unix, iff the admins know what they are doing. Why do you think that before virtualization got popular people were using shell accounts, chroots and BSD Jails for their webhosting/IRC/... needs? Why do you think we have CGI, SuExec, ...? I won't deny that VPS are great, but a properly set up shell server will allow you to do many of the same things a VPS can do.
- zokier 15y ago
  > The Unix security model is designed for mutli-user hosts. Reminds me of the story of RMS complaing about evil admins that were restricting root level access. The views on computer users and security were quite different in the early days of UNIX. edit: link http://news.ycombinator.com/item?id=2518881 http://news.ycombinator.com/item?id=2518881
  - gaius 15y ago
    RMS' views might have been different. In a little thing we call actual reality the sysadmin is an employee hired by the same people who bought the system (no small investment in those days) to maintain it, and I don't think any reasonable person has ever denied that.
zokier 15y ago
The shared hosting I'm using has restricted access for users above certain UID to other peoples home directories, regardless of the permission bits.

hkolk 15y ago

I had to inform a professor he was running an open home directory like that. Pretty tricky to do as it implies you were looking for it in the first place.

ryanbraganza 15y ago
How did you do it?
Roritharr 15y ago
I learned my lesson about never talking about the security flaws i found in school. Our web access went over secured proxy servers, which determined via our windows login which services to allow or disallow us. As our deputy rector considered himself an open IT advocate, he ensured all browsers we're installed on all machines, including Opera. Back then Opera couldn't use the Windows login to auth with the proxy server, which he "fixed" by using a pre-configured user which just had student rights. As i'd never use opera i didn't notice it until one of my teachers tried to block me from using any webmail client as a way to transfer files to the school pc. Trying different things i got the tip from a classmate to start opera. I was struck by a preentered login box which i was told to just hit ok. I got curious and inspected the fields. The loginname had admin in it, so i thought the password might be used elsewhere... Well, i've seen our deputy rector on our central win 2003 server via windows remote desktop before, so i connected to it, using the user and pass from opera and logged in to an open session on the server which stored all critical school data, including grades of all students attending that school and the transfer tool to send the grades to the statewide server which would make the grades final. As it was so ridiculously easy i got scared that someone from my class would do the same and then get into deeper trouble for actually trying to change grades or something, i immediately went to our deputy rector and told him all about it. He banned me from using school pc's for the rest of the year and afterwards all teachers were told to keep their eyes on what i was doing on the school pcs...
- zdw 15y ago
  Imagine if you had just changed the background picture on the server you accessed to a lolcat or something funny, and left a short text file how you got in, saying that you didn't change anything. Even better would be to change the password, then leave him an anonymous typed note with it, which would prevent others from abusing the system. True anonymous reporting is almost as good as whistleblower protection.