| 1 |
On 12/09/2011 10:49 AM, Grant wrote: |
| 2 |
> |
| 3 |
> There is a Squirrelmail document recommending that the Squirrelmail |
| 4 |
> data and attachments directories are established outside of the web |
| 5 |
> server's reach. /var is given as an example. |
| 6 |
|
| 7 |
The two aren't mutually exclusive; using the previous example, we have, |
| 8 |
|
| 9 |
php_admin_value upload_tmp_dir /var/www/example.com/www/tmp |
| 10 |
DocumentRoot /var/www/example.com/www/public |
| 11 |
|
| 12 |
so Apache can't serve up the temporary files. But sticking them both |
| 13 |
under /var/www/example.com/www does allow you to use tighter |
| 14 |
open_basedir restrictions. |
| 15 |
|
| 16 |
|
| 17 |
> This is a little disturbing because my Squirrelmail data directory was |
| 18 |
> created under the webroot as apache:apache 0755 at some point. Would |
| 19 |
> this have been done by Gentoo? Should I file a bug? |
| 20 |
|
| 21 |
I'm not sure. There's probably a policy that says one of two things: |
| 22 |
|
| 23 |
1. Ebuilds should by default set up everything as securely as |
| 24 |
possible, or |
| 25 |
|
| 26 |
2. Ebuilds should not mess with upstream |
| 27 |
|
| 28 |
I've honestly never used Gentoo's webapp stuff; it confuses the hell out |
| 29 |
of me. |
Archives