Re: [cobalt-developers] FW: Cobalt RaQ 3 security hole?

["H.P. Stroebel" <hpstr@xxxxxxxxxxxxx>]

Tony schrieb:
> 
> Seems to be factory-default:
> Apache on port 81 DOES run as root/root.

it`s necessary, so the gui scripts can change the config files (they`re
running as root). if you change user/permissions, it will not work
anymore. maybe one could mess around with setuid-bits, but that`s a
risk, too.

i shut down apache for the gui (for some minutes, only to test it), and
the raq works without gui.

you can install ssl for the main site to encrypt the gui traffic.

if you don`t like it at all, you`ll have to shut down the gui (but why
did you buy a raq ?)
nevertheless, a raq 3 is not a very secure system. if you want that,
you`ll have to build one from scratch, which requires time and
relatively high unix skills, but that`s not the market that cobalt
points to (at least i think :-)

cu

-- 

H. P.  Stroebel, Germany

CGI-FAQ for Raq-Newbies :
http://users.iol.it/hpstr/

Yes, I do. But not Yahoo.