[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [cobalt-users] protecting text files in my cg-bin directory from prying eyes

these are not security holes...

rather it is the way you have set up your scripts...

i would imagine you can tell your script where to write your files?
make a directory on your server ahead of your "web' folder, a non public area of your server and your problems will be solved.
all of our database and pasword information is stored in non public accessable areas of our server....
where in the world do you get the notion that your specific problem is in fact a security hole? 


From: "Dan Kriwitsky" <dan@xxxxxxxxxxxxx>
Reply-To: <dan@xxxxxxxxxxxxx>
To: <cobalt-users@xxxxxxxxxxxxxxx>
Subject: RE: [cobalt-users] protecting text files in my cg-bin directory from prying eyes 
Date: Fri, 20 Oct 2000 13:22:32 -0400
> I have searched the archives and found lots of posts on directory browsing 
> and how to disable it.  I have a more specific question.  I have added
> index.html files to all my directories to keep people from being able to
> get directory listings via there web browsers.  However, they can still
> view any non-executable files via their browser if they happen to know or 
> guess the file name.  For example, I have several log and data files
> written to by my cgi-bin scripts that live in my cgi-bin directory. Some 
> of these files contain sensitive information and I do not want
> people to be
> able to read the files via their browsers.
>
> What is the easiest way to fix this security hole?
>
Move the logs to /home/sites/site#/new_dir
Since they're "above" the web directory, they can't be browsed.

--
Dan Kriwitsky



_______________________________________________
cobalt-users mailing list
cobalt-users@xxxxxxxxxxxxxxx
To Subscribe or Unsubscribe, please go to:
http://list.cobalt.com/mailman/listinfo/cobalt-users


_________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.
Share information about yourself, create your own public profile at http://profiles.msn.com.