Re: iSeries vs IIS web site

[Joe Pluta <joepluta@xxxxxxxxxxxxxxxxx>]

And just as an aside, I don't know who wrote the part you're reading, 
but on my machine, neither QTMHHTTP nor QTMHTTP1 have write authority on 
any of my folders, and my website runs off my iSeries.  So there's not a 
snowball's chance that you can hack my machine with an Apache exploit.

Joe

> Proves my point.  QTMHTTP1 is read only.  QTMHHTTP may not be, but user
> jobs don't run as QTMHHTTP, they run as QTMHTTP1.  If you can use an
> Apache exploit to run a job as QTMHHTTP, feel free to let me know.
> Until then, I'm pretty comfortable that normal IBM i security protocols
> are sufficient.
>
> Joe
>
> > "Which is entirely read-only."
> >
> > Actually, it is not.  From the 7.1 InfoCenter:
> >
> > The QTMHTTP1 user profile is the default user profile that HTTP Server uses
> > when running CGI programs. This user profile must have read and execute
> > authority to the location of any CGI program. User QTMHHTTP requires *RWX
> > (write) authority to directory '*/tmp*'.
> >
> > You can optionally specify that the QTMHHTTP or QTMHHTP1 user profile swap
> > to another user profile as long as that user profile has the required
> > authorities.
> >
> >      - *RX authority for root directory ("/ ") and directory "/www", including
> >      all subdirectories in the path
> >      - *RWX authority for directory "/www/server_name/"