Re: Apache VS IIS Securiyt model question

[exon <exon () home se>]

mthompson wrote:
> Hello,
>
> I am doing research and I am stuck. 
>
> Pitch: In IIS there is the ability to set permissions on a per website
> basis. In other words the ability to limit access to files and
> directories based on the users credentials that the website is running
> under. Additionally, you would in turn add this user to a group and
> apply group permissions to an object that needed to be accessed by more
> than one site.

Microsoft is simply mimicing the way most unix filesystem works.

Take the extended filesystem, versions 2 and 3 (which is standard for 
Linux installations) for example.
Each filesystem node (file, directory, pipe, socket etc) is assigned a 
'permission list' (in lack of a better word) for;
a/ the user who owns the file
b/ the group who owns the file
c/ everybody else
These permissions can be empty or any combination of read, write and 
execute.

An additional value can be set for each file and directory to let (for 
example) people who execute a script or program do so as the user or 
group owning the executable. There are many more options for this extra 
value, but I'm sure you get the idea.

All of this is handled at kernel level, and can't be circumvented by 
anyone but root, who always has read and write access to everything (and 
execute permissions if any of the permission lists contain the execute bit).

> Question: Is there a similar security model for apache that would allow
> credentials from a user to run a virtual website and access files only
> for a specific virtual site.

Short answer; Yes. I have set it up myself at numerous occasions. See 
above for details.
Long answer; Apache has a 'suexec' feature (executing code or reading 
webpages as a different user). I'm not sure how well implemented this is 
for Windows type operating systems, but the apache website should be 
able to provide you with more answers.
The best way to run apache though would still be on a unix platform. MS 
hasn't quite managad to convince me of their networking stability just yet.

> Also, does any one have a diagram of the apache process?

I know some goofball sat down and wrote execution schematics for a bunch 
of opensource networking daemons a while back to analyze likely future 
points of failure, but I don't know where to find them, and I'm not sure 
they were ever made publically available (seeing as the reason for their 
creation was somewhat shady in the first place).

> Thanks,

You're welcome.

> Mike 

/exon