RE: [cobalt-developers] FW: Cobalt RaQ 3 security hole?

["Lyle Scheer" <lyle@xxxxxxxxxx>]

Now personally, I'm a security paranoid sort of person, so when I set up
ftp.cobaltnet.com, I did things like disable POP and IMAP, install ssh, and
disable the admin server... I shut down all services that were not being
used.  I even disable the root password and use only RSA keypairs for
access.

My theory is thus:
	- all software has risk of security holes.  Minimize the risk by minimizing
the services running.

People are constantly finding exploits in all sorts of different code.  The
risk with running Apache as root is a similar risk... run it as an
unprivileged user, and the most access someone can gain with the Apache
process is the access level the process is running at.

I figure that once you have a box configured, you don't use the web
interface that often, so you should shut it down, and only turn it on when
you need to modify something.

The simple method I use to disable the admin server is to rename
/etc/rc.d/init.d/admserv (I think that's the name) to another name so that
activemonitor can't restart it, and then issue a
"/etc/rc.d/init.d/renamed.admserv stop" or "/etc/rc.d/init.d/renamed.admserv
start" when I want to turn it on or off.  ActiveMonitor complains a bit
about this, but I ignore it.

- Lyle