I really dislike the idea of a Samba share being the DocumentRoot. I do like Drew's idea of an SVN repository. How important is the PDF file format to them? Would it be easier (more appropriate) to use a wiki to create the documents? I haven't researched it, but I'm willing to bet there are some wikis out there that allow export to PDF for a topic.
bd On Sun, May 24, 2009 at 12:27 AM, drew wymore <[email protected]> wrote: > <snip> > > > > > Ed > > > > 1. The customer wants users to be able to contribute content > > to their Web server, which runs Apache and MySQL on Linux. > > Most of the time, this means users saving PDF documents > > to the Web server so other users can access them via their > > browsers. > > > > He has Samba running and has configured the Web site's > > DocumentRoot to be a Samba share. Every user in the > > company can now access all the Web site data. The > > MySQL tables are not in DocumentRoot but there are PHP > > files in the DocumentRoot that access the tables. I'm > > guessing he thinks he'll control security by only mapping > > drive letters for certain users. > > > > I mentioned to the customer that this is a significant > > security issue and that there are more secure ways for > > users to contribute content but he is unconvinced (see > > item 2). > > > > > Using a Samba share like this could pose huge risks if a virus gets > involved. It could potentially write to the webserver depending on what it > was. I actually had this issue waaaaaay back in the day and learned my > lesson the hard way. > > Perhaps something like setting a Subversion repo would be a reasonable > alternative since there are Windows GUI tools available and SVN are web > accessible and can be easily controlled in regards to access that are much > more prudent than drive mapping. > > > > > > 2. The customer ignores security issues because: > > > > a) He claims they are on a "private network"; they are safe. > > The Web server serves only internal users; it cannot be > > accessed directly from the Internet. However, their > > "private network" is not private in the sense of NAT > > and RFC1918 private addressing. Everyone in the company > > has a public IP address. Every desktop computer runs > > Windows with the usual complement of Windows applications. > > > > Their border gateway/firewall provides insulation from the > > outside but I'm able to use a variety of protocols, such as > > SSH, to make connections to hosts on the Internet from > > their network. He seems to be unaware of threats that > > originate from the inside. > > > > b) Their virus scanners are up to date. > > > > > This is less of an issue from a security standpoint given there is a router > in place, provided the router is secured properly. > > Drew- > _______________________________________________ > PLUG mailing list > [email protected] > http://lists.pdxlinux.org/mailman/listinfo/plug > _______________________________________________ PLUG mailing list [email protected] http://lists.pdxlinux.org/mailman/listinfo/plug
