Frequently Asked Questions
CONTENTS
- Q20 Are there any known problems with WebStar?
- Q21 Are there any known problems with MacHTTP?
- Q22 Are there any known problems with Quid Pro Quo?
- Q23 Are there any known problems with Novell WebServer?
- Q24 What information do readers reveal that they might want to keep private?
- Q25 Do I need to respect my readers' privacy?
- Q26 How do I avoid collecting too much information?
- Q27 How do I protect my readers' privacy?
-
General
- Q1 What's the problem with CGI scripts?
- Q2 Is it better to store scripts in the cgi-bin directory or to identify them using the .cgi extension?
- Q3 Are compiled languages such as C safer than interpreted languages like Perl and shell scripts?
- Q4 I found a great CGI script on the Web and I want to install it. How can I tell if it's safe?
- Q5 What CGI scripts are known to contain security holes?
-
Language Independent Issues
- Q6 I'm developing custom CGI scripts. What unsafe practices should I avoid?
- Q7 But if I avoid eval(), exec(), popen() and system(), how can I create an interface to my database/search engine/graphics package?
- Q8 Is it safe to rely on the PATH environment variable to locate external programs?
- Q9 I hear there's a package called cgiwrap that makes CGI scripts safe?
- Q10 People can only use scripts if they're accessed from a form that lives on my local system, right?
- Q11 Can people see or change the values in "hidden" form variables?
- Q12 Is using the "POST" method for submitting forms more private than "GET"?
- Q13 Where can I learn more about safe CGI scripting?
-
Safe Scripting in Perl
- Q14 How do I avoid passing user variables through a shell when calling exec() and system()?
- Q15 What are Perl taint checks? How do I turn them on?
- Q16 OK, I turned on taint checks like you said. Now my script dies with the message: "Insecure path at line XX" every time I try to run it!
- Q17 How do I "untaint" a variable?
- Q18 I'm removing shell metacharacters from the variable, but Perl still thinks it's tainted!
- Q19 Is it true that the pattern matching operation $foo=~/$user_variable/ is unsafe?
- Q20 My CGI script needs more privileges than it's getting as user "nobody". How do I run a Perl script as suid?
- Q1 What types of access restrictions are available?
- Q2 How safe is restriction by IP address or domain name?
- Q3 How safe is restriction by user name and password?
- Q4 What is user verification?
- Q5 How do I restrict access to documents by the IP address or domain name of the remote browser?
- Q6 How do I add new users and passwords?
- Q7 Isn't there a CGI script to allow users to change their passwords online?
- Q8 Using .htaccess to control access in individual directories is so convenient, why should I use access.conf?
- Q9 How does encryption work?
- Q10 What are: SSL, SHTTP, Shen?
- Q11 Are there any "freeware" secure servers?
- Q12 Can I use Personal Certificates to Control Server Access?
- Q13 How do I accept credit card orders over the Web?
- Q14 What are: CyberCash, SET, Open Market?
- Overview
- Q1 What is a Denial of Service attack?
- Q2 What is a Distributed Denial of Service attack?
- Q3 How is a DDoS executed against a website?
- Q4 Is there a quick and easy way to secure against a DDoS attack?
- Q5 Can the U.S. Government make a difference?
- Step-by-Step
- Q6 How do I check my servers to see if they are active DDoS hosts?
- Q7 What should I do if I find a DDoS host program on my server?
- Q8 How can I prevent my servers from being used as DDoS hosts in the future?
- Q9 How can I prevent my personal computer from being used as a DDoS host?
- Q10 What is a "smurf attack" and how do I defend against it?
- Q11 What is "trinoo" and how do I defend against it?
- Q12 What are "Tribal Flood Network" and "TFN2K" and how do I defend against them?
- Q13 What is "stacheldraht" and how do I defend against it?
-
Q14 How should I configure my routers,
firewalls, and intrusion detection systems against DDoS attacks?
| Table of Contents |
| Forward to Introduction |
|  |
 |
 |
 |
