From: "Gopher-Project" <gopher-project-bounces+rachael=telefisk.org@lists.alioth.debian.org> Date: Tue Jan 5 20:10:59 2016 Subject: Re: [gopher] Another batch of Motsognir questions Hi Martin, A short update about Motsognir's status: 1. a minute ago I commited a patch to Motsognir's svn that will make it execute CGI sub-gophermaps regardless of their extension, so there's no requirement to name them as *.cgi any more (unless you want to call them outside of gophermaps, too). I think it's more user-friendly this way, since the administrator already said "execute this" by using the "=" gophermap operator, so there's no point in looking for a *.cgi extension on top of that. 2. I think, too, that declaring a list of "allowed non-root gopher directories" is the more secure way to go. It's a somewhat complex change that I need to triple-test very carefully before making it public, so I will probably work on it no sooner than next weekend. cheers, Mateusz On 04/01/2016 15:20, Martin Kukac wrote: > Hello Mateusz, > > thanks for the quick response. > > 1. Even though I'm from Mac back on PC for most of the time, I still > forget about extensions :-) Scripts had the correct permissions, correct > shebang and when I tried to run them from bash, they worked. Gophernicus > apparently didn't care about extensions and just used whatever output > executable file returned. After renaming to *.cgi everything works, so > for me it's solved. > > 2. For me both variants are OK, the list of "gopher-served directories" > sounds more secure though, so I would go with that. > > Martin > > > > On 01/04/2016 01:29 PM, Mateusz Viste wrote: >> Hi Martin, >> >> 1. The extension of the file matters. Try renaming your *.sh to *.cgi - >> does it work then? Do not forget to have the file marked as executable >> (chmod +x) and declare a correct shebang inside it (#!/bin/sh) >> How would you see it done another way? I'd be willing to adapt this if >> there's a way that would be significantly more user friendly. >> >> 2. Indeed motsognir doesn't allow to access anything that is not inside >> the gopher root, because... well, just because :) if something is not >> inside the gopher root, then it's not supposed to be offered by gopher. >> >> If you think it would be useful, I can add a feature that would disable >> symlink resolution while performing evasion detection checks. OR - maybe >> better - allow to declare a list of "gopher-served directories", where >> you could declare all non-gopher-root directories that are likely to be >> served via symlinks - what do you think? >> >> Mateusz >> >> >> >> On 04/01/2016 12:55, Martin Kukac wrote: >>> Hello and happy new year to all! >>> >>> I have some further questions about how (and why) Motsognir works. Even >>> though I could send it directly to Mateusz, I'm asking here, because it >>> may help others in the future. I hope y'all don't mind. >>> >>> 1. external scripts >>> >>> On my gopher server I have bash, perl and PHP scripts and the do not >>> behave the same way. I include all of them in the gophermap using "=", >>> all of them have 755 permissions, but only PHP seems to work. >>> >>> To test it I placed this in the gophermap: >>> >>> =test.pl >>> =test.sh >>> =test.php >>> >>> All files had just a single line of code, printing "iTest.PL", >>> "iTest.SH" and "iTest.PHP". The resulting gophermap returned to client >>> only the output contained only PHP output, in /var/log/messages I found >>> >>> Jan 4 12:34:47 i-logout journal: motsognir [46.13.138.74][11235]: >>> running server-side app '/var/gopher/test.php' >>> >>> Nothing else. What am I missing? I can rewrite all scripts to PHP if I >>> have to, but isn't there another way? >>> >>> >>> 2. directories outside GopherRoot >>> >>> When using Gophernicus, I had some directories all over the filesystem >>> symlinked to GopherRoot and listed through gopher. Motsognir seems to >>> prevent this because it thinks it is evasion attempt: >>> >>> Jan 4 12:50:44 i-logout journal: motsognir [46.13.138.74][11396]: >>> Requested resource: /software/ / Local resource: /var/gopher/software/ >>> Jan 4 12:50:44 i-logout journal: motsognir [46.13.138.74][11396]: >>> Evasion check: path '/var/gopher/software/' (/var/ftp/pub/) do not seem >>> to belong to '/var/gopher/' >>> Jan 4 12:50:44 i-logout journal: motsognir [46.13.138.74][11396]: >>> Evasion attempt. Forbidden! >>> >>> Is this necessary? I can't imagine how there could be symlinked folder >>> without my knowledge, so this could be probably allowed. >>> >>> Thanks for the help. >>> >>> Martin _______________________________________________ Gopher-Project mailing list Gopher-Project@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/gopher-project Thread start (DIR) [gopher] Another batch of Motsognir questions (DIR) Followup: Re: [gopher] Another batch of Motsognir questions