I need to write a web application that acts as a configuration interface for some system services. Meaning it will probably change some kind of configuration file and has to restart (linux) system services.
I was wondering how to design such a thing in a secure way. It is very similar to router web interfaces and such, so I had a quick look at some of these as well as webmin.
Basically, I could run the web service/CGI-Script/etc. with root privileges, filter the input as good as possible and just write to the system and execute whatever program I’d like.
This does not seem very secure. I would like to achieve some kind of privilege separation.
Maybe having my web app run as unprivileged user and pass the Information to some privileged daemon/service, i.e., having a Python web app writing the infos to a file and notifying the daemon or use unix sockets to communicate with this backend program.
Any ideas or experience you could share regarding this issue?
Thank you very much in advance.
2
You’ve mostly answered your own question. You’re right to dislike running the web app as root, no matter how you run it. You’re right to look at separation of priviledge to bridge the gap between the less- and more-secure environments. I’d just add that your chosen bridge (and I like text files for this) should describe the action to be performed, not the technique by which it is performed. So have your less-secure environement write an “action file” that says restart_cron instead of /etc/init.d/crond restart. And have your more-secure environment check the contents of the “action file” very carefully, especially anything that it winds up invoking as part of a command. In general, if you think of a way to make the more-secure environment simpler to use by the less-secure, go in the opposite direction.
3