winnt , cgi perl security, txt db's 3

[Lrnmore]

I am using a perl cgi script to send mail,
I also record the data in a small file so that
if we experience mail server issues the customer's
orders can be retrieved. What if any are the security
risks? I realize that if a person knows the name of my
text file it can be downloaded, but that would only be
possible if that person downloaded my .pl or .cgi file
and then extracted the text file name---right????

If you don't mind could you give me some hints about
loopholes and how to close them. Even some hints regarding
what I should ask my webhost about his system and settings
on my account would be greatly appreciated.

Thanks,
Mark

2b||!2b

 

[tviman]

If you know the location of the text file, it doesn't need a script to download it. If you want to keep your customer's data secure, put it in an SSL protected area or a password protected directory. Also, NEVER send credit card numbers via e-mail. Normally, e-mail is not secure. There are ways of encrypting e-mail but it's still not a good idea to send credit card or checking account info via e-mail.

One method would be to write the order to an SSL protected database on your server. Then, on a regular basis, download the contents of the database to a local machine. Once done, clear the online database (just in case). Any email that you want to send (to your client or their customers) could be taken from the database after the info is written to the file. But this should only be in the form of an order acknowledgement or an "Order has been placed" email. NO PAYMENT INFO in the email!

There's always a better way. The fun is trying to find it!

 

[Coderifous]

Yea, as far as being secure:

NO ftp
NO smtp (email)
NO telnet

INSTEAD USE:

scp (secure copy)
sftp (secure ftp)
ssh (secure shell)

And as for storing a file server side, and worrying about someone accessing it directly via a URL, this can be pretty easily diverted:

Solution A)
Put the file in a directory that is not accessible under the document root directory. Most webservers are configured to NEVER serve files that:
start with ".ht", or
end with "~"
Ask your ISP if this is the case, and if not, ask if they can make it the case. You could then modify your files name so that they are "dissallowed" via normal http GETS. But your CGI script would still be able to modify it on the server side.

Solution B)
Confuse the web server!!!!! Make it a perl script with the data in it! Take the file, add a .pl to the end of the name (or otherwise make it a CGI script), and add this to the top of the file:

use CGI;
my $j = new CGI;
print $j->redirect("[URL unfurl="true"]http://www.gofish.com");[/URL]
exit(0);
__END__

YOUR DATA CAN ALL GO HERE!

This way, even if someone DOES find out the path to your file, when they request it via http, they will get sent elsewhere. If you want to have fun, send them to a porno-pop-up-hell website. That what's I do to people that try to hack my website.

Solution C)
Have your CGI script open a connection to another server (at your house for example), and have it store the data there, instead of on your public web server.

Hope this helps,

--jim

 

[PaulTEG]

Solution B, I like that ...
--Paul

 

[duncdude]

What a fantastic answer! ;-)

A star for that!

Duncan

 

[Lrnmore]

Thanks for the great information
and suggestions!!

Mark

2b||!2b