Re: [cobalt-users] FileMan 2.0 Available as a package!

[Alex Krohn <alex@xxxxxxxxxxxxxxxxxxxx>]

Hi,

> I installed the package on one of our test-RAQ's, and it looks great!
> It's easy to use and I really like the option to create a password
> protected dir, and editing the file permissions. 
> 
> I will test it more today to see if I can find any bugs ;).  I'm only
> looking at security now. Is this more insecure than FTP ? (yes, FTP is
> also insecure). 

Probably just as secure as ftp. It uses basic authentication which will
send the username/pass over clear text much like mail or ftp does. 

> Maybe it's an idea to create a SSL for the main site,
> and redirect users to:
> 
> http://your.cobalt.raq/fileman/fileman.cgi
> 
> It could be an option :]

Definately, if you wrapped it in https://, you would eliminate the
sending of password over clear text. To make this change, edit
/home/gossamer/fileman/lib/fileman.pl. The fileman.cgi is a setuid
wrapper that just changes user and runs fileman.pl.

I'd be interested to hear anything else you find.

Cheers,

Alex

-- 
Alex Krohn <alex@xxxxxxxxxxxxxxxxxxxx>