Re: [gentoo-user] Re: [Fwd: Re: Gentoo Rules]

[Randy Barlow]

Etaoin Shrdlu wrote:
> (btw, do gentoo initscripts
> support starting multiple instances of a daemon, perhaps under different
> users and using different parameters? I'd not bet on it, but I may be
> wrong. If it's not supported, waiting for baselayout to support this may
> take a long time, so it would be better to release the easier suid
> version in the meanwhile.)

It's not too hard to start a separate instance of apache.  You just copy
/etc/init.d/apache2 to, say, /etc/init.d/backuppcApache2.  Likewise copy
the /etc/conf.d scripts, and change in the backuppc one the reference to
the httpd.conf to, say, /etc/BackupPC/httpd.conf.  Then, in that .conf
file, make sure that you change the things to be suitable for BackupPC
(in particular, get rid of the lines that include *.conf's from certain
directories because these will cause apache to try and use the same PID!
 Make sure you specify a new PID file, among a few other related things)
 I really don't think the ebuild should let you use the same instance of
apache that /etc/init.d/apache2 starts, because this would be a security
risk.  For example, I use BackupPC to back up three machines, in their
entirety.  That means that backuppc has the rights to change any files
on those three machines.  I've also got a webserver running, open to the
internet, on my backuppc machine.  If people on the internet can access
backuppc, they can pretty much access all three of those other machines.
 But if I run on port 8080, and have that port blocked by a firewall,
this is no longer a concern.

The other option is to install password protection by default, but then
you have to have competent users who can change the httpd passwords.  I
suppose you could write this as an instruction at the end of the ebuild.
 But, are htaccess passwords sent in plaintext?  If so, that's also a
major security risk.

-- 
Randy Barlow
http://electronsweatshop.com
-- 
gentoo-user@g.o mailing list