1 RT2 runs setgid to some group (it defaults to 'rt').
3 rt's configuration file, 'config.pm', is not world readable because it
4 contains rt's database password. If a user gets access to this file, he
5 can arbitrarily manipulate the RT database. This is bad. You don't want
6 this to happen. config.pm is mode 550. No users should be members of
7 the 'rt' group unless you want them to be able to obtain your rt password.
9 If you're running the web interface, you'll need to make sure your webserver
10 has access to config.pm. You could do this by letting your webserver's user
11 be a member of the 'rt' group. This has the disadvantage of letting
12 any mod_perl code on your web server have access to your RT password.
14 Alternatively, you can run RT2 on its own apache instance bound to a high
16 which runs as a non-priviledged user which is a member of the group 'rt'.
18 Configure your webserver to proxy requests to RT's
19 virtual directory to the apache instance you just set up.
21 TODO: doc the apache configs needed to do this.
23 The same technique can be used to run multiple RT2 instances on the same host.