Netsoc

Major Upgrade

In the coming weeks we are going to upgrade the webserver software
on matrix from Apache 1 to Apache 2. In the process, we’re making many important
changes to our webserver infrastructure. We expect that this can cause some hiccups,
so we’re currently running new software in test mode. To test your site under
the new webserver, please check out
www.netsoc.tcd.ie:88/~yourname

(replace yourname with your uername, duh).

Here’s a summary of changes we’re introducing:

• New major Apache version. We’re switching to Apache 2.0, which is the latest
  available version. For more information, read the
  documentation.
• New minor PHP version. We’re switching to PHP 4.3.9, which is the latest
  available stable version.
• More PHP modules available. We’ve enabled many more PHP modules. Some of them
  are available as extensions, others are compiled in.
• Availability of CGI. We’re allowing CGI script execution. Simply create a
  directory ~/www/cgi-bin, then chmod 711 ~/www/cgi-bin, and put
  your cgi scripts in there. To be executed correctly, their names must end in
  .cgi, and their permissions should be set as chmod go-w. The
  scrips need not be world-readable.
• Execute-as-user. Under the new server, both CGI and PHP scripts execute
  under the user ID of the user who owns them. That’s right, your scripts
  run as a local process launched by you. We’re using
  suEXEC and
  suPHP to achieve this.

Implication of execute-as-user.

Good:

• Security. You no longer need world-readable files to get your scripts
  to work. You can safely make files containing passwords and such readable only
  by you.
• Files modified by scripts. You now can run software that needs write access
  to files, such as Gallery, counter scripts, etc, much more securely. Where before
  you had to make files and directories globally-writable (and risk them being overwritten
  by someone malicious), now you don’t need to do anything like that. The scripts should
  just work.
• Wider range of applications. The new scheme should hopefully let you run a much
  broader range of web applications, much more securely.

Bad:

• Security. The main potential problem lies in the fact that the scripts run as you.
  So they have exactly the same privileges as you do. Normally this isn’t a problem, however
  if your scripts contain security vulnerabilities you can be in trouble. If someone can force
  your scripts to execute arbitraty files, or even execute commands, the can access all your files
  and hijack your account. You should take care with what scripts you have on your website.
• Speed. There will be a slight performance penalty for php scripts due to a
  different way they’re treated. Hopefully, it won’t be too noticable.

We will put the new webserver in place in the next few weeks,
which should give everyone plenty of time to check all of their
webpages. The date of changeover will be announced in advance.

If you do find any problems please send the address of
the troublesome page and the details of the problem to the helpdesk