RE: [cobalt-security] Security issue regarding Sites Backups

["Chris Burton" <chris@xxxxxxxxxxxxxxxxxx>]

> Cobalt Backup is not a utility for moving a site from one box to the 
> other.

My personal gripe with the Cobalt Backup in the GUI is any user with
login or cgi perms can look at the what your password is to the ftp
server, they wait for the backup to be running and then look at the
cmdline in proc.

E.g. 
# I see backup running here (all done as a std user)
32648 pts/1    S      0:04 perl
/usr/admserv/cgi-bin/.cobalt/backup/backup.cgi
# look at the process
cd /proc/32648
cat cmdline

And in that we have a nice line 

perl/usr/admserv/cgi-bin/.cobalt/backup/backup.cgi-bcomplete-tcomplete-p
ftp-rUSER@HOST-s420--passwordPASSWORD

Is there anything that can be done with this ?

Yours,
 Chris Burton