Les Mikesell wrote:
What I have done, in Debian and without selinux, where I want CGI to
do root stuff is to authorise it without passwords via sudo,
Is there some reason to think this is better than the methods provided
by apache or perl?
Two things I like about it:
1. I know how to use SUDO. I've forgotten how to do it in Apache.
2. It's automatically logged that it's done. If I must, I can identify
which computer did it.
For you to better assess my stupidity:
It controls whether the stewed ants can have Internet. Possibly, they
could turn it off if they knew how, but once it's off they can't get to
the web site to turn it on, turning it off blocks all egress from their
LAN, servers aside.
Assuming they knew how, those most likely to turn it off are those most
likely to want it on. We don't think they would do it often:-)
The site's on a private IP. Any staff can turn it on or off. You have to
be on the premises to do it, or have a VPN. The Boss and I have a VPN.
--
Cheers
John
-- spambait
1aaaaaaa@xxxxxxxxxxxxxxxx Z1aaaaaaa@xxxxxxxxxxxxxxxx
-- Advice
http://webfoot.com/advice/email.top.php
http://www.catb.org/~esr/faqs/smart-questions.html
http://support.microsoft.com/kb/555375
Please do not reply off-list
