[Tutor] my membership and access to the Tutor list

[Alan Gauld]

On 08/05/15 09:09, Stewart Lawton wrote:
> Hi Alan
> Thank you very much for your response to my Tutor at python.org question.
> I thought my membership was complete and that I could log in to answer 
> your comments.

The tutor list is a mailing list not a web forum. You don't login to answer
comments you  send an email reply. Use Reply to send to the individual
(as you've just done with me) or, more usually, use ReplyAll (or ReplyList
if your mail tool has that feature) to reply to everyone on the list.

Use plain text to preserve code layout and use interleaved posting
(as I'm doing here) rather than top-posting.

> I found I could not login again. PLEASE can you help to get my 
> password reset?

Only you can change the password, its purely web based. I only
approve messages in the moderation queue, virtually nothing else.
But the password just gives you access to your admin settings.

> I think I am failing to understand what user and or group permissions 
> are required between apache python, and the python myUnix2.cgi program 
> I am using.

OK, I'm no expert here but several things about your program
have me puzzled.

First remember that the web server will have its own user account
and thus your code is effectively being run by another user. So any
permissions on your files need to allow that user to have access.
This is obviously a security risk and the reason its best not to have
web programs accessing files in a users area but to copy any files
needed into the web server space.

> This program script is listed below, hopefully with spaces corrected

Spacing is now legal, but you should increase the indentation to
make it more readable. Consider 2 spaces as the absolute minimum,
most people use 3 or 4. If you ever submit code to the Python
standard library it must use 4 spaces. One space makes the
indentation hard to line up and almost defeats the point of
having it.

> path to uds_socket corrected as Felix Dietricl suggested may be and Issue.


> 1) From my user directory I issued the script Unix2.cgi to
> a listening Unix sockets server and this worked OK.
> 2) the permissions of Unix2.cgi are:-
> -rwxrwxrwx. 1 johnlawton johnlawton  987 May  7 17:55 myUnix2.cgi
> This is not good from security but surely proves the script can execute if
> permissions are not considered.
> 3)This file is copied to the apache cgi directory /var/www/cgi-bin 
> with the permissions
> forced as
> -rwxrwxrwx. 1 johnlawton johnlawton 987 May  7 18:19 
> ../../../var/www/cgi-bin/myUnix2.cgi
> 4) Execution of the cgi script directly works OK.

OK, Permissions of the cgi script are not critical they just need to be
executable to the web server. So you could have ---r-xrwx and it should
be more secure and work OK. What is important is that you change
ownership to whatever the apache user account is (local config, I can't
help there you'll need to look at the files).

> 5) http is enabled in the fedora firewall
> 6)The apache server is started using sudo systemctl start httpd.service.
> When firefox is used to have Unix2.cgi executed the localhost receives 
> the following error report.
>
> Traceback (most recent call last):
>
>   File "/var/www/cgi-bin/myUnix2.cgi", line 37, in <module>
>     creSockettoServer()
>   File "/var/www/cgi-bin/myUnix2.cgi", line 26, in creSockettoServer
>     sys.exit(1)
> SystemExit: 1
>
> 7) The copy process of myUnix2.cgi from my user directory to 
> /var/www/cgi-bin
> but setting user and group to root with full permissions results in
> -rwxrwxrwx. 1 root root 987 May  7 18:45 
> ../../../var/www/cgi-bin/myUnix2.cgi

OK, But I sincerely hope the web server is NOT running as root, that 
would be
a security disaster and a crackers paradise!

> 8)When firefox is used to have Unix2.cgi executed the localhost 
> receives the
> same error report given under 6).
> 9) summary since the 'o' permissions are forced to rwx the script 
> should execute
> no matter what use group are specified?
> 10) How do I establish neccessary cgi permissions?
The problems are not with your script but with the socket you are trying to
create, or the path to it. Its those permissions that likely need to be 
changed.
> #!/usr/bin/env python
> import cgi
> import socket
> import sys
> def htmlTop():
>  print("""Content-type:text/html\n\n
>  <DOCTYPE html>
>  <html lang="en">
>    <head>
>        <meta charset="utf-8" />
>        <title> MyServer Template </title>
>        </head>
>        <body>""")
>
> def htmlTail():
>  print("""<body/>
>        </html> """   )
>
> def creSockettoServer():
>     sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
>     server_address = '/home/johnlawton/workspace/myUnixSock/uds_socket'

I confess I've never used a socket like this, indeed I was only
vaguely aware of their existence! I assume you have previous
experience of using UNIX domain sockets (in C?) since there
is relatively little tutorial help out there.

I've always used sockets for IP and given an IP address to the socket.
So I can only guess what's going on in your case. Can I ask what you
are trying to do in your program that you need UNIX sockets? Just curious.
Also one thing that occurs to me - have you made sure the socket file
is being deleted each time before you run the program? An existing
socket file may well cause your problems.

Back to the issue at hand...
Can you write a simpler CGI script that just prints data or similar?
That way you can check that your CGI setup is working first
and then focus on the issue of opening the socket. I'm a big believer
in solving one problem at a time.

In fact you could then write a second script that reads your socket
folder and prints a dir listing using os.listdir() or glob() or similar to
prove basic access is OK. It might also print some info about the
user so that you know which account is running your scripts.

Armed with that information you can then tackle the issue of
creating your socket file.

I've CCd the list so that others can contribute too.

-- 
Alan G
Author of the Learn to Program web site
http://www.alan-g.me.uk/
http://www.amazon.com/author/alan_gauld
Follow my photo-blog on Flickr at:
http://www.flickr.com/photos/alangauldphotos