Security
In pyWM all data files are owned by the user Apache runs as.
For the purposes of this document, we'll assume that's 'nobody.'
Some things to know
Inside of the pyWM installation directory, everything critical
is kept inside of "data/"
- data/<user_name>/session.pik does contain the POP3 password
in clear text for the duration of the session; that is, until logout
or timeout occurs.
- data/<user_name>/minfo.pik does contain headers for every
email on the POP3 server, more or less in clear text.
- data/<user_name>/messages/ contains locally-cached emails
for each user, more or less in clear text.
These documents are all mode 700, owned by 'nobody.' This means that
in pyWM, giving any local user the ability to execute code as
'nobody' gives them control of the pyWM installation.
Solutions
These solutions depend greatly on just how much you want to lock
down your server.
- Ideal: Run pyWM on a dedicated server.
- Great, but a pain: Run two Apache installations. One on
80, and one on 8080 (or some other port).
Run one as nobody, and the other as pywm (you'll have to add the user.)
Use mod_proxy to connect the two, or just point your users to 8080 for
their mail.
- Good: Don't give any other users permission to run CGI scripts.
- Trust and Pray: If only you and a few friends use your box, I
suppose this one would work. :c)
(Up to Index)
|
(Next: Problems?)