The World Wide Web Security FAQ

MIRROR SITES FOR THIS DOCUMENT

• http://cip.physik.uni-wuerzburg.de/www-security-faq.html
• http://www.usma.edu/mirror/WWW/www-security-faq

CONTENTS

1. Introduction
2. What's New?
3. General Questions
   • Q1 What's to worry about?
   • Q2 Exactly what security risks are we talking about?
   • Q3 Are some Web servers and operating systems more secure than others?
   • Q4 Are some Web server software programs more secure than others?
   • Q5 Are CGI scripts insecure?
   • Q6 Are server-side includes insecure?
   • Q7 What general security precautions should I take?
   • Q8 Where can I learn more about network security?
4. Running a Secure Server
   • Q9 How do I set the file permissions of my server and document roots?
   • Q10 I'm running a server that provides a whole bunch of optional features. Are any of them security risks?
   • Q11 I heard that running the server as "root" is a bad idea. Is this true?
   • Q12 I want to share the same document tree between my ftp and Web servers. Is there any problem with this idea?
   • Q13 Can I make my site completely safe by running the server in a "chroot" environment?
   • Q14 My local network runs behind a firewall. How can I use it to increase my Web site's security?
   • Q15 My local network runs behind a firewall. How can I get around it to give the rest of the world access to the Web server?
   • Q16 How can I detect if my site's been broken into?
5. Protecting Confidential Documents at Your Site
   • Q17 What types of access restrictions are available?
   • Q18 How safe is restriction by IP address or domain name?
   • Q19 How safe is restriction by user name and password?
   • Q20 What is user verification?
   • Q21 How do I restrict access to documents by the IP address or domain name of the remote browser?
   • Q22 How do I add new users and passwords?
   • Q23 Isn't there a CGI script to allow users to change their passwords online?
   • Q24 Using .htaccess to control access in individual directories is so convenient, why should I use access.conf?
   • Q25 How does encryption work?
   • Q26 What are: SSL, SHTTP, Shen?
   • Q27 How do I accept credit card orders over the Web?
   • Q28 What are: First Virtual Accounts, DigiCash, Cybercash?
6. CGI Scripts
   • Q29 What's the problem with CGI scripts?
   • Q30 Is it better to store scripts in the cgi-bin directory or to identify them using the .cgi extension?
   • Q31 Are compiled languages such as C safer than interpreted languages like Perl and shell scripts?
   • Q32 I found a great CGI script on the Web and I want to install it. How can I tell if it's safe?
   • Q33 What CGI scripts are known to contain security holes?
   • Q34 I'm developing custom CGI scripts. What unsafe practices should I avoid?
   • Q35 But if I avoid eval(), exec(), popen() and system(), how can I create an interface to my database/search engine/graphics package?
   • Q36 Is it safe to rely on the PATH environment variable to locate external programs?
   • Q37 I hear there's a package called cgiwrap that makes CGI scripts safe?
   • Q38 People can only use scripts if they're accessed from a form that lives on my local system, right?
   • Q39 Can people see or change the values in "hidden" form variables?
   • Q40 Is using the "POST" method for submitting forms more private than "GET"?
   • Q41 Where can I learn more about safe CGI scripting?
7. Safe Scripting in Perl
   • Q42 How do I avoid passing user variables through a shell when calling exec() and system()?
   • Q43 What are Perl taint checks? How do I turn them on?
   • Q44 OK, I turned on taint checks like you said. Now my script dies with the message: "Insecure path at line XX" every time I try to run it!
   • Q45 How do I "untaint" a variable?
   • Q46 I'm removing shell metacharacters from the variable, but Perl still things it's tainted!
   • Q47 Is it true that the pattern matching operation $foo=~/$user_variable/ is unsafe?
   • Q48 My CGI script needs more privileges than it's getting as user "nobody". How do I run a Perl script as suid?
8. Server Logs and Privacy
   • Q49 What information do readers reveal that they might want to keep private?
   • Q50 Do I need to respect my readers' privacy?
   • Q51 How do I avoid collecting too much information?
   • Q52 How do I protect my readers' privacy?
9. Client Side Security
   • Q53 Someone suggested I configure /bin/csh as a viewer for documents of type application/x-csh. Is this a good idea?
   • Q54 Is there anything else I should keep in mind regarding external viewers?
   • Q55 How do I turn off the "You are submitting the contents of a form insecurely" message in Netscape? Should I worry about it?
   • Q56 How secure is the encryption used by SSL?
   • Q57 My Netscape browser is displaying a form for ordering merchandise from a department store that I trust. The little key at the lower left-hand corner of the Netscape window is solid and has two teeth. This means I can safely submit my credit card number, right?
   • Q58 How private are my requests for Web documents?
   • Q59 What's the difference between Java and JavaScript?
   • Q60 Are there any known security holes in Java?
   • Q61 Are there any known security holes in JavaScript?
10. Specific Servers
    • Windows NT Servers
      • Q62 Are there any known problems with the Netscape Servers?
      • Q63 Are there any known problems with the WebSite Server?
      • Q64 Are there any known problems with Purveyor?
      • Q65 Are there any known problems with Microsoft IIS?
    • Unix Servers
      • Q66 Are there any known problems with NCSA httpd?
      • Q67 Are there any known problems with CERN httpd?
      • Q68 Are there any known problems with Apache httpd?
      • Q69 Are there any known problems with the Netscape Servers?
      • Q70 Are there any known problems with the IBM ICSS Server?
      • Q71 Are there any known problems with the WN Server?
    • Macintosh Servers
      • Q72 Are there any known problems with WebStar?
      • Q73 Are there any known problems with MacHTTP?
11. Bibliography