Re: 'at' command and apache user

2011-06-17 Thread Rick Stevens
On 06/17/2011 11:12 AM, Robert Cates wrote: > On 06/17/2011 01:56 PM, Tim wrote: >> Ed Greshko: Depending on the type of web pages you serve you may find there to be a buffer overflow vulnerability which gives an attacker a shell and allows them to execute arbitrary commands as "apac

Re: 'at' command and apache user

2011-06-17 Thread Robert Cates
On 06/17/2011 01:56 PM, Tim wrote: > Ed Greshko: >>> Depending on the type of web pages you serve you may find there to be a >>> buffer overflow vulnerability which gives an attacker a shell and allows >>> them to execute arbitrary commands as "apache". >>> >>> I smell "danger Will Robinson"! > Gar

Re: 'at' command and apache user

2011-06-17 Thread Tim
Ed Greshko: >> Depending on the type of web pages you serve you may find there to be a >> buffer overflow vulnerability which gives an attacker a shell and allows >> them to execute arbitrary commands as "apache". >> >> I smell "danger Will Robinson"! Gary Stainburn: > You do have a valid point, b

Re: 'at' command and apache user

2011-06-17 Thread Gary Stainburn
On Friday 17 June 2011 09:32:59 Ed Greshko wrote: > Depending on the type of web pages you serve you may find there to be a > buffer overflow vulnerability which gives an attacker a shell and allows > them to execute arbitrary commands as "apache". > > I smell "danger Will Robinson"! You do have a

Re: 'at' command and apache user

2011-06-17 Thread Ed Greshko
On 06/17/2011 04:24 PM, Gary Stainburn wrote: > Thanks Gents, > > Shadow already had !! but passwd had /sbin/nologin > > Changed it to /bin/bash and it works great. I'm not so sure giving user apache a shell is a good idea. Depending on the type of web pages you serve you may find there to be a b

Re: 'at' command and apache user

2011-06-17 Thread Gary Stainburn
On Friday 17 June 2011 01:40:18 Rick Stevens wrote: > On 06/16/2011 04:41 PM, Cameron Simpson wrote: > > On 16Jun2011 18:58, Gary Stainburn wrote: > > | Hopefully this is a quickie. I've written a Perl script which > > | > > | 1) I call to initialise - this then schedules another run using the >

Re: 'at' command and apache user

2011-06-16 Thread Rick Stevens
On 06/16/2011 04:41 PM, Cameron Simpson wrote: > On 16Jun2011 18:58, Gary Stainburn wrote: > | Hopefully this is a quickie. I've written a Perl script which > | > | 1) I call to initialise - this then schedules another run using the 'at' > | command > | > | 2) is run by 'at' at the appropriate

Re: 'at' command and apache user

2011-06-16 Thread Cameron Simpson
On 16Jun2011 18:58, Gary Stainburn wrote: | Hopefully this is a quickie. I've written a Perl script which | | 1) I call to initialise - this then schedules another run using the 'at' | command | | 2) is run by 'at' at the appropriate time to carry out the required task | | This works fine und

'at' command and apache user

2011-06-16 Thread Gary Stainburn
Hi Folks, Hopefully this is a quickie. I've written a Perl script which 1) I call to initialise - this then schedules another run using the 'at' command 2) is run by 'at' at the appropriate time to carry out the required task This works fine under the developer user but when I call it from PH