Re: [ProgSoc] Server Side Includes

Anand Kumria (
Wed, 8 Oct 1997 01:06:02 +1000 (EST)

On Tue, 7 Oct 1997 wrote:

> For whoever it was who wanted to know how to finger
> themselves, ;), I had a go at it this afternoon.

Too bad you didn't enjoy it ....

> For some st00pid reason, the CGI works on SoCS and
> also on my Linux server at work, but it _DOESNT_ work on
> ftoomsh. (Fucked if I know why .. ?)

The difference is because ProgSoc doesn't trust you to write CGI scripts
correctly, so we run them using your user id instead. That way if you make
a mistake and open up a hole, the only thing that might be damaged is your
own account.

That said, sucgi is fairly paranoid about doing what it does. One of the
things it does do (apart from making sure the owner and group of the CGI
match what was requested, it isn't a symlink, etc.) is to clear the PATH
environment variable. Change the command so it executes /usr/ucb/finger,
and it should work.

I determined all this by checking /var/log/web/sucgi_log, then
/var/log/web/access_log and finally /var/log/web/error_log (where the
command not found ends up).

> P.S. A Chupa Chup goes to the person that can figure out why
> the CGI works itself into an infinite loop on
> ftoomsh, but not anywhere else .... ?

I didn't see this behaviour at all, I watched your processes using 'top'
and I saw the finger CGI appear briefly and then disappear.


 `When any government, or any church for that matter, undertakes to say to
  its subjects, "This you may not read, this you must not see, this you are
  forbidden to know," the end result is tyranny and oppression no matter how
  holy the motives' -- Robert A Heinlein, "If this goes on --"

You are subscribed to the progsoc mailing list. To unsubscribe, send a
message containing "unsubscribe" to
If you are having trouble, ask for help.

This list is archived at <>