Re: FN-FORUM: DNS chrooted - should I bother?

date posted 1st November 2003 00:22


Cheers Alex,=20

belt, braces, and supplementary string to be applied! on everything.


Ok suplementary questions,=20
The server is to host a number of database driven sites (PHP/Mysql), and =
email=20
for the associated domains, this will use spamassasin and clam AV with=20
postfix, and GPG for secure email. =20
The box needs to do its own pimary DNS, with the secondary being provided=
by=20
my ISP.
So.... should I think about djdbns? I think that my ISP is using BIND, so=
I=20
thought that it would be sensible to use it too. but I guess thas a bit =
like=20
using red hat all the time.
B**ls - just read the bit that says that I would need to have access to =
the=20
ISPs DNS server (my secondary) - No Chance.

so its bind then! Chrooted.=20

I need to be able to allow some access to ftp from dreamweaver for some o=
f my=20
clients, I looked at their method of SSL - using putty and plink, and my=20
users won't be upto it. =20

What are your suggestions for an ftp package? which ones can be run as a=
n=20
unprivilidged user rather than root? =20

and how can I make that more secure ? ( assume I will have done the basic=
s -=20
no anonymous etc)=20

The thing that worries me is that I will have to give the user acess to p=
hp =20
pages which may allow all sorts of nasties and if I was thinking of black=
=20
hats that would be an easy way to inject malicious code, becuse the ftp=
=20
service is so inherently vulnerable, and just about all of the dangerous =
php=20
permissions are global, and the paranoid settings that most ISPs offer is=
why=20
I need to run my own sever!
obviously you have to assume that an oridinary ftp login is completely=20
isecure, Could I implement a system which ran completely isolated from t=
he=20
rest of the file structure ?
Then I can identify the user in some other way in order to validate thier=
=20
changes? it means keeping two copies but what the hell!

Third question - one which I haven't looked in detail at yet - do you kno=
w of=20
any good references on how to secure MySQL?

Ta=20
Carrie