diff options
| author | cvs2git <cvs2git> | 2004-04-07 09:08:35 +0000 |
|---|---|---|
| committer | cvs2git <cvs2git> | 2004-04-07 09:08:35 +0000 |
| commit | 022491d9d2723ca4d7d0718cdb1fd67e7652428e (patch) | |
| tree | fc1e50c0d78ecc401ef2214a6a11ee07242be0f8 /rt/docs/Security | |
| parent | 35effa1bf4ac902547615c816960bbc8db8e7256 (diff) | |
This commit was manufactured by cvs2svn to create tag 'NET_WHOIS_RAW_0_31'.NET_WHOIS_RAW_0_31
Diffstat (limited to 'rt/docs/Security')
| -rw-r--r-- | rt/docs/Security | 25 |
1 files changed, 0 insertions, 25 deletions
diff --git a/rt/docs/Security b/rt/docs/Security deleted file mode 100644 index c9787ac52..000000000 --- a/rt/docs/Security +++ /dev/null @@ -1,25 +0,0 @@ -RT2 runs setgid to some group (it defaults to 'rt'). - -rt's configuration file, 'config.pm', is not world readable because it -contains rt's database password. If a user gets access to this file, he -can arbitrarily manipulate the RT database. This is bad. You don't want -this to happen. config.pm is mode 550. No users should be members of -the 'rt' group unless you want them to be able to obtain your rt password. - -If you're running the web interface, you'll need to make sure your webserver -has access to config.pm. You could do this by letting your webserver's user -be a member of the 'rt' group. This has the disadvantage of letting -any mod_perl code on your web server have access to your RT password. - -Alternatively, you can run RT2 on its own apache instance bound to a high -port on 127.0.0.1 -which runs as a non-priviledged user which is a member of the group 'rt'. - -Configure your webserver to proxy requests to RT's -virtual directory to the apache instance you just set up. - -TODO: doc the apache configs needed to do this. - -The same technique can be used to run multiple RT2 instances on the same host. - - |