Path: csiph.com!usenet.pasdenom.info!gegeweb.org!de-l.enfer-du-nord.net!feeder2.enfer-du-nord.net!feeds.phibee-telecom.net!newsfeed.xs4all.nl!newsfeed3.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail
MIME-Version: 1.0
In-Reply-To: <70390d65-5313-46bf-8110-b25f5fc9f76f@googlegroups.com>
References: <20a49aac-3867-481f-96d4-c95a050781ed@googlegroups.com> <51AD70E8.70506@gmail.com> <mailman.2626.1370332265.3114.python-list@python.org> <6c0ed9da-0f29-4b6b-a804-771763454dd4@googlegroups.com> <mailman.2630.1370341322.3114.python-list@python.org> <mailman.2631.1370343886.3114.python-list@python.org> <4ed43a69-0dfe-4078-a836-db5201811761@googlegroups.com> <mailman.2634.1370345254.3114.python-list@python.org> <2e1dbdc2-6bca-4c4e-93b0-4c0cddb72bc1@googlegroups.com> <03d8964e-7cea-4072-b1f1-19d83e494191@googlegroups.com> <mailman.2637.1370346181.3114.python-list@python.org> <a93d5fee-e49d-4b6b-a663-059784ae0a74@googlegroups.com> <mailman.2640.1370347946.3114.python-list@python.org> <b0d71538-8af8-471b-854c-0a7c23a90840@googlegroups.com> <mailman.2645.1370351460.3114.python-list@python.org> <4b65cdfe-b6c2-4d97-8623-77b10711bf78@googlegroups.com> <mailman.2651.1370356391.3114.python-list@python.org> <2ecc95c4-6114-49a6-ad47-df7bae4adfde@googlegroups.com> <kokupf$24d$1@ger.gmane.org> <CAMw+j7J=ibDTi9c9dxjx_=zuoecFxLawP2KmGjbhBztEC1nWZA@mail.gmail.com> <CAPTjJmrZH1qC=X+LNenXyReNjQT4FmVTKqL24H0D0An0XK9kAg@mail.gmail.com> <mailman.2656.1370359764.3114.python-list@python.org> <592c84d8-2e86-4480-b784-c3ccadc8360d@googlegroups.com> <mailman.2666.1370365761.3114.python-list@python.org> <06fd6c2e-0979-4d61-b75a-6d9df7c1b624@googlegroups.com> <mailman.2688.1370383955.3114.python-list@python.org> <70390d65-5313-46bf-8110-b25f5fc9f76f@googlegroups.com>
Date: Wed, 5 Jun 2013 18:09:50 +1000
Subject: Re: Apache and suexec issue that wont let me run my python script
From: Chris Angelico <rosuav@gmail.com>
To: python-list@python.org
Content-Type: text/plain; charset=ISO-8859-7
Content-Transfer-Encoding: quoted-printable
Precedence: list
Newsgroups: comp.lang.python
Message-ID: <mailman.2706.1370419798.3114.python-list@python.org>
Lines: 36
NNTP-Posting-Host: 2001:888:2000:d::a6
Xref: csiph.com comp.lang.python:47033

On Wed, Jun 5, 2013 at 1:55 PM, =CD=E9=EA=FC=EB=E1=EF=F2 =CA=EF=FD=F1=E1=F2=
 <nikos.gr33k@gmail.com> wrote:
> Good Day Chris, thanks for accepting.
>
> Please mail me and i will send you the root login credentials.

Well, I wasn't sure whether this would actually happen or not, but it did.

I made it fairly clear to him in multiple posts that I was NOT going
to sort out all his problems, yet he clearly did not read that, and
has seen fit to compromise his security to the extreme extent of
giving his *ROOT PASSWORD* to a total stranger over the internet.

With that power, I could have done anything. I could have wiped out
all his clients' data. I could have searched through his database
content for credit cards, customer information, the works. But I
didn't; I merely placed a small file in the public_html directory of
each of the twelve web sites he has hosted:

http://superhost.gr/Hello_from_Rosuav
http://leonidasgkelos.com/Hello_from_Rosuav
http://parking-byzantio.gr/Hello_from_Rosuav
... and nine others

I have also contacted all the site owners who had a .contactemail file
in their home directories, informing them of the situation.

Oh, and I changed the root password, since the current one was sent in
clear text across the internet. Nikos, the new password has been
stored in /home/nikos/new_password - you should be able to access that
using your non-root login. I recommend you change it immediately.

Peanut gallery, did I make it sufficiently clear beforehand that
giving out your root password is a bad idea?

ChrisA