Date: Mon, 9 Feb 2004 23:37:43 +0000 From: Lewis Thompson <purple@lewiz.net> To: FreeBSD-questions <questions@freebsd.org> Subject: Shell script containing passwords. Message-ID: <20040209233743.GA58010@lewiz.org>
next in thread | raw e-mail | index | archive | help
--5mCyUwZo2JvN/JJP Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi, I'm trying to write a script to use with the Apache auth plugin mod_auth_any. I have the whole setup working, bar the script that does the authentication. I am worried that because the script must be read/writeable by the Apache user (www) that anybody that can write a PHP script on my machine can read the auth script and read the passwords that would be contained within -- those to my MySQL server. Is there any way I can have a script that is not readable by a user, while still allowing that user to execute it? Maybe through using a wrapper of some sort? I do not have UFS2 so I cannot use ACLs. Any suggestions for this as I'm stumped. Thanks very much, -lewiz. --=20 I was so much older then, I'm younger than that now. --Bob Dylan, 1964. ------------------------------------------------------------------------ -| msn:purple@lewiz.net | jabber:lewiz@jabber.org | url:www.lewiz.org |- --5mCyUwZo2JvN/JJP Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (FreeBSD) iD8DBQFAKBnHItq0KFQv7T8RAggkAKDlAeCfwgk73L5ImP29gnfT6z/zTQCbB6JH d00AUpVg9Crk3qDTo308MKw= =Zblf -----END PGP SIGNATURE----- --5mCyUwZo2JvN/JJP--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040209233743.GA58010>