pyWM
 
 
 

Security

In pyWM all data files are owned by the user Apache runs as. For the purposes of this document, we'll assume that's 'nobody.'

Some things to know

Inside of the pyWM installation directory, everything critical is kept inside of "data/"

These documents are all mode 700, owned by 'nobody.' This means that in pyWM, giving any local user the ability to execute code as 'nobody' gives them control of the pyWM installation.

Solutions

These solutions depend greatly on just how much you want to lock down your server.


(Up to Index)   |   (Next: Problems?)