headers
Xan xan | 1 Oct 2010 20:48
Picon

Re: perl scripts (oddmuse)

Anyone could help me?

Regards,
Xan.

2010/9/27 xancorreu <xancorreu <at> gmail.com>:
> Hi,
>
> Is there any way for running perl scripts? I put virtual domain--> rules -->
> add --> extensions --> pl --> cgi --> and /usr/bin/perl. But I get error
> 504 Gateway Timeout
>
>
> With thttpd it works.
> What can I do?
>
> Thanks,
> Xan.
>
> PS: I attach cherokee.conf
>
> ------------------------------------------------------------------------
>
> config!version = 001000008
> server!bind!1!port = 8081
> server!group = www-data
> server!keepalive = 1
> server!keepalive_max_requests = 500
> server!panic_action = /usr/share/cherokee/cherokee-panic
> server!pid_file = /var/run/cherokee.pid
(Continue reading)

Permalink | Reply | 0 comments |
headers
David Taylor | 3 Oct 2010 09:28
Gravatar

Cherokee failing to exec spawn-fcgi

  Hi,

I have configured a MoinMoin wiki vServer in Cherokee 1.08.  I am 
getting 503 Service Unavailable whenever I request a page.

It looks like Cherokee is failing to execute spawn-fcgi.

When I run Cherokee from the command line and request a page I see the 
following:

root <at> hal:/var/log/cherokee# /usr/sbin/cherokee --admin_child -C 
/etc/cherokee/cherokee.conf
Cherokee Web Server 1.0.8 (Aug 18 2010): Listening on port ALL:80, TLS 
disabled,
IPv6 enabled, using epoll, 4096 fds system limit, max. 2041 connections,
caching I/O, 20 threads, 102 connections per thread, standard scheduling
policy
PID 1765: launched '/bin/sh -c exec /usr/bin/spawn-fcgi -n -a 127.0.0.1 
-p 53993 -- /usr/share/moin/server/moin.fcg' with uid=33, gid=33, 
env=inherited
PID 1765: exited re=1
PID 1766: launched '/bin/sh -c exec /usr/bin/spawn-fcgi -n -a 127.0.0.1 
-p 53993 -- /usr/share/moin/server/moin.fcg' with uid=33, gid=33, 
env=inherited
PID 1766: exited re=1
PID 1767: launched '/bin/sh -c exec /usr/bin/spawn-fcgi -n -a 127.0.0.1 
-p 53993 -- /usr/share/moin/server/moin.fcg' with uid=33, gid=33, 
env=inherited
PID 1767: exited re=1
PID 1768: launched '/bin/sh -c exec /usr/bin/spawn-fcgi -n -a 127.0.0.1
(Continue reading)

Permalink | Reply | 12 comments |
headers
"Juan J." Martínez | 3 Oct 2010 10:36
Gravatar

Re: Cherokee failing to exec spawn-fcgi

El dom, 03-10-2010 a las 18:28 +1100, David Taylor escribió:
> Hi,
> 
> I have configured a MoinMoin wiki vServer in Cherokee 1.08.  I am 
> getting 503 Service Unavailable whenever I request a page.
> 
> It looks like Cherokee is failing to execute spawn-fcgi.

Once Cherokee drops privileges and switches user (I don't know your
case, www-data may be?), it can't spawn the CGI process with a different
user (it needs to run as root to do that).

> Any hints/suggestions on what I should do?

Can you tell us the users you're trying to use for Cherokee and you CGI?

I guess one solution it's to run the CGI with the same user than
Cherokee (as long as Cherokee isn't running as root, in that case you
could run the CGI with any user you want).

Another solution would be set the suid flag in the CGI span-fcgi, and
chown the file to the user/group you want to use to run it. In that way
Cherokee should be able to ejecute the file with the right user without
being root.

Cheers,

Juanjo

--

--
(Continue reading)

Permalink | Reply | 9 comments |
headers
"Juan J." Martínez | 3 Oct 2010 10:45
Gravatar

Re: Cherokee failing to exec spawn-fcgi

El dom, 03-10-2010 a las 09:36 +0100, Juan J. Martínez escribió:
> [...]
> 
> Another solution would be set the suid flag in the CGI span-fcgi, and
> chown the file to the user/group you want to use to run it. In that way
> Cherokee should be able to ejecute the file with the right user without
> being root.

Sorry, I was talking in theory :). In practice, it won't work if your
spawn-fcgi it's a shell script.

Cheers,

Juanjo

--

-- 
jjm's home: http://www.usebox.net/jjm/
blackshell: http://blackshell.usebox.net/
 ramble on: http://rambleon.usebox.net/

_______________________________________________
Cherokee mailing list
Cherokee <at> lists.octality.com
http://lists.octality.com/listinfo/cherokee
Permalink | Reply | 3 comments |
headers
xancorreu | 3 Oct 2010 11:22
Picon

Re: perl scripts (oddmuse)

  Well, guys, If no one could help me, I will to try other web server 
with less annoying cgi configuration (lighttpd or thttpd). I want to try 
cherokee because it's clear more faster.

Xan.

Al 27/09/10 21:59, En/na xancorreu ha escrit:
> Hi,
>
> Is there any way for running perl scripts? I put virtual domain--> 
> rules --> add --> extensions --> pl --> cgi --> and /usr/bin/perl. But 
> I get error
> 504 Gateway Timeout
>
>
> With thttpd it works.
> What can I do?
>
> Thanks,
> Xan.
>
> PS: I attach cherokee.conf
>
> ------------------------------------------------------------------------
>
> config!version = 001000008
> server!bind!1!port = 8081
> server!group = www-data
> server!keepalive = 1
> server!keepalive_max_requests = 500
(Continue reading)

Permalink | Reply | 6 comments |
headers
"Juan J." Martínez | 3 Oct 2010 11:27
Gravatar

Re: perl scripts (oddmuse)

El dom, 03-10-2010 a las 11:22 +0200, xancorreu escribió:
> Well, guys, If no one could help me, I will to try other web server 
> with less annoying cgi configuration (lighttpd or thttpd). I want to try 
> cherokee because it's clear more faster.

I don't think you have the same problem than David (check that thread)
because "vserver!1!rule!105!handler!change_user" it's 0 in your
configuration.

You're running Cherokee as www-data:www-data, so I'd check permissions
first. Can www-data user run the command you have setup in the
script_alias to execute any of the pl files?

# su -m www-data -
$ /usr/bin/perl /whatever/file.pl

Does it work?

Cheers,

Juanjo

--

-- 
jjm's home: http://www.usebox.net/jjm/
blackshell: http://blackshell.usebox.net/
 ramble on: http://rambleon.usebox.net/

_______________________________________________
Cherokee mailing list
Cherokee <at> lists.octality.com
(Continue reading)

Permalink | Reply | 5 comments |
headers
David Taylor | 3 Oct 2010 11:58
Gravatar

Re: Cherokee failing to exec spawn-fcgi

  On 03/10/10 19:36, Juan J. Martínez wrote:
> El dom, 03-10-2010 a las 18:28 +1100, David Taylor escribió:
>> Hi,
>>
>> I have configured a MoinMoin wiki vServer in Cherokee 1.08.  I am
>> getting 503 Service Unavailable whenever I request a page.
>>
>> It looks like Cherokee is failing to execute spawn-fcgi.
> Once Cherokee drops privileges and switches user (I don't know your
> case, www-data may be?), it can't spawn the CGI process with a different
> user (it needs to run as root to do that).
>

Hola Juan,

Cherokee is running as www-data:www-data.

Cherokee is not trying to exec spawn-fcgi as a different user -- there 
is no -u or -g specified in the command line.  It's using exec to run it 
in a separate process with inherited privileges:

PID 1765: launched '/bin/sh -c exec /usr/bin/spawn-fcgi -n -a 127.0.0.1 
-p 53993 -- /usr/share/moin/server/moin.fcg' with uid=33, gid=33, 
env=inherited
PID 1765: exited re=1

On my system, uid 33 and gid 33 are www-data:www-data:

root <at> hal:/var/log/cherokee# grep 33 /etc/passwd
www-data:x:33:33:www-data:/var/www:/bin/sh
(Continue reading)

Permalink | Reply | 4 comments |
headers
"Juan J." Martínez | 3 Oct 2010 12:33
Gravatar

Re: Cherokee failing to exec spawn-fcgi

El dom, 03-10-2010 a las 20:58 +1100, David Taylor escribió:
> [...]
> It does work from the command line.  But when Cherokee does it, it fails.

I can see a difference. Cherokee uses /bin/sh -c exec ... Is it possible
that there's something in the spawn-fcgi script that makes it behave
differently?

I don't know, may be the PATH it's different and it's failing to execute
something (?).

> ps.  I just noticed this mailing list doesn't set reply-to, so this is a 
> re-send.  Sorry for the duplicate e-mail, Juan.

NP, you're welcome :)

Cheers,

Juanjo

--

-- 
jjm's home: http://www.usebox.net/jjm/
blackshell: http://blackshell.usebox.net/
 ramble on: http://rambleon.usebox.net/

_______________________________________________
Cherokee mailing list
Cherokee <at> lists.octality.com
http://lists.octality.com/listinfo/cherokee
(Continue reading)

Permalink | Reply | 3 comments |
headers
"Juan J." Martínez | 3 Oct 2010 15:01
Gravatar

Running process as a different user (was Cherokee failing to exec spawn-fcgi)

El dom, 03-10-2010 a las 09:45 +0100, Juan J. Martínez escribió:
> El dom, 03-10-2010 a las 09:36 +0100, Juan J. Martínez escribió:
> > [...]
> > 
> > Another solution would be set the suid flag in the CGI span-fcgi, and
> > chown the file to the user/group you want to use to run it. In that way
> > Cherokee should be able to ejecute the file with the right user without
> > being root.
> 
> Sorry, I was talking in theory :). In practice, it won't work if your
> spawn-fcgi it's a shell script.

OK, thinking about it... I wrote a simple tool to accomplish that: run
whatever you want from a suid program, so you can spawn the fast-cgi
stuff as a different user that the one running Cherokee.

It was very easy to do, but quite insecure (it allows any user to run
anything as the target user), so I added a simple ACL so you can limit
the commands to be executed and the users allowed to do so.

And I stopped there, because I don't want to reimplement SUDO!

If someone want to play with it:

http://www.usebox.net/jjm/suidexec/

Some people asked for suEXEC support in Cherokee, this might do the
trick, but obviously without any kind of warranty ;)

It's been roughly tested and any comment it's welcome.
(Continue reading)

Permalink | Reply | 2 comments |
headers
David Taylor | 3 Oct 2010 16:11
Gravatar

Re: Cherokee failing to exec spawn-fcgi

  On 03/10/10 21:33, Juan J. Martínez wrote:
> El dom, 03-10-2010 a las 20:58 +1100, David Taylor escribió:
>> [...]
>> It does work from the command line.  But when Cherokee does it, it fails.
> I can see a difference. Cherokee uses /bin/sh -c exec ...

Any ideas how to debug what's going on in spawn-fcgi?

As far as I can tell, it's not running anything at all:

www-data <at> hal:~$ /bin/sh -c exec /usr/bin/spawn-fcgi -n -a 127.0.0.1 -p 
53993 -- /usr/bin/python -c "open('/tmp/testing', 'w').write('this is a 
test under exec\n')"
www-data <at> hal:~$ cat /tmp/testing
cat: /tmp/testing: No such file or directory

www-data <at> hal:~$ /usr/bin/spawn-fcgi -n -a 127.0.0.1 -p 53993 -- 
/usr/bin/python -c "open('/tmp/testing', 'w').write('this is a test 
without exec\n')"
www-data <at> hal:~$ cat /tmp/testing
this is a test without exec

How do I begin to debug this?

> Is it possible
> that there's something in the spawn-fcgi script that makes it behave
> differently?
>
> I don't know, may be the PATH it's different and it's failing to execute
> something (?).
(Continue reading)

Permalink | Reply | 2 comments |

Gmane