* Bruce Smith (bw...@re...) wrote:
> > We could go a completely new route:
> > Setup is only very basic, just enough to get the network up and
> > running. Then use Webmin for the rest.
> > We would only need to add DL specific changes to Webmin, which has a
> > pretty nice web interface. Webmin is all Perl.
>
> Aside from the fact I don't know perl, there are advantages and
> disadvantages to both approaches.
>
> The advantages of a web interface is it looks much nicer, easier to
> use, and easier to program (at least it would be in PHP).
>
> The disadvantages of a web interface is it's a potential security
> hole. This gives root access via a web interface to the machine, and
> someplace for bad people to brute force attach the password remotely.
> Without a certificate, passwords would be sent plain text across the
> network. And it could accidentally be exposed to the internet. One
> more disadvantage is the overhead of requiring a web server to be
> running all the time (increase the memory requirements!).
Security hole is not the fact of the language. How many php application
get buggy and have at lease one security update per month ?
I do myself application using perl + Catalyst framework. It is very easy
to create a secure web apps, and easier to test since Catalyst provide
in same way an autonomous server, cgi and fast-cgi.
The manrdriva Corporate server admin tools is a web apps using Catalyst.
Created by Raphael Garcia-Suarez, the authentication is done over PAM,
and allow to install packages, setup basis configuration, etc...
Catalyst:
http://www.catalystframework.org/
Here an example of web site in catalyst:
http://sophie.zarb.org/
I am not arging perl si the solution, just saying perl is not less
secure than php. Security problem in programming design are the same:
system() call with forged variable will have same effect everywhere,
especially since the command have to be ran as root.
The only thing making me saying than perl is more secure is perl is
ofter used by Sys-admin, more looking side effect on security than web
designer mostly using php (I hope it's the case ! :)
Regards.
>
> The setup/console/curses approach requires physical access to the
> console of the machine (unless ssh is activated), making it much more
> secure. Plus the lower resource requirements. Of course the
> disadvantage is it's clunky to use and looks like crap. That's why I
> was hoping there was something like 'dialog' that looked better and
> was easier to program.
>
> Are the potential security risks worth going to a web based admin?
> More thoughts? :-)
>
> - BS
>
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry(R) Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay
> ahead of the curve. Join us from November 9 - 12, 2009. Register now!
> http://p.sf.net/sfu/devconference
> _______________________________________________
> Devil-linux-develop mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devil-linux-develop
--
Olivier Thauvin
CNRS - LATMOS
♖ ♘ ♗ ♕ ♔ ♗ ♘ ♖
|
