Re: qmail publicfile : need advice

Victor Stanescu writes:
> First, i would say that regarding the hardware, a P3 would perform
> better, because of the bigger cache. IDE disks should be cheaper, but
> the RAID offers you the same protection and you'll be able to buy

SCSI should last longer than IDE if the disk is under a lot of load.  If you
can afford SCSI for a heavily used server, then you should certainly use it.
As for the CPU, AMD hardware would be a better choice for cost / performance
ratio.

> bigger hard disks. Use the linux distribution that you are most used
> with. You can do whatever you want which each distribution (if you
> know unix and linux well enough, the small differences between
> vendors should not be a problem to you), but it's easier to work with
> the one that you had time to study from head to tail and you have a
> good idea about each script and the place of each configuration file.

Then for me I would set it up on FreeBSD :)

> Publicfile will not be a real replacement for apache, because it
> servers only static content, but considering the environment
> (students want everytime to hack the server, and if they can use
> dynamic pages, your work will be harder just to check what are they
> doing) it is the best option.

Agreed.  However, trusting a lot of high school students to have local
access to a machine that will never be monitored or updated is just asking
for trouble.

> You should also consider vsftpd for ftp upload - i think it is the
> only free secure ftp server (yet).

What makes it secure?  Any FTP server that allows file modification is
insecure.  Not to mention the cleartext passwords:

http://cr.yp.to/ftp/security.html

SSH should be used for file transfer.  In a high school environment, you
just asking for trouble if you use insecure protocols.  There are good sftp
clients available for Win32:

http://www.chiark.greenend.org.uk/~sgtatham/putty/

> One more advantage for this setup (djbdns and publicfile) would be
> that you will be able to map *.your.domain to an IP address, then any
> query like something.your.domain will be solved to that IP. As you
> know, publicfile servers the page for http://something.your.domain
> from /public/file/something.your.domain/, so if you just make a user
> with the home directory /public/file/something.your.domain, it is
> done. No need to restart web server, no need to restart the dns
[snip]
> This will look better than www.your.domain/~something.

Apache does this just fine:

http://httpd.apache.org/docs/vhosts/mass.html

It is simply a matter of creating a symlink to the user's web directory when
the account is created.

> service - you might even automate this with a mail form that is send
> to a specific mailbox, where a script gets it (with | script in
> .qmail) and performs those this step (useradd -m)

This is just asking for trouble.  A secure way to do it would be a CGI
script that runs over SSL.  Of course, this would need to be a separate web
server from the one that serves content for the main users, as the web
server would need root access in order to add users.

> Don't allow telnet/ssh sessions to the machine from students. A
> machine is really secure only when you have no kind of shell access
> on it. If you have, it is just a matter of time.

While I agree with this to some extent (we don't allow shell access at our
hosting company), you must realize that giving people access to run scripts
is the same thing as giving shell access.  Not giving shell access but
allowing scripts is not going to stop people that really want to get in.
What it does do is stop casual abuse, like denial of service attacks, IRC
bots, etc.

This is like thinking that you are safe because you use SSH, yet you leave
FTP enabled.  While every bit helps, serious attackers will use the weakest
link.

> You might also consider to put near an old machine (like a 100 Mhz
> pentium, 200Mhz i guess it will be too much) to set on it a minimally
> configured apache server (not the default install from most
> distributions i mean) with some webmail interface that accesses the
> accounts via pop3 and does not store informations locally. (you can
> find some on freshmeat). This way, you will offer web access to
> reading e-mail, without a real care about security - they find a way
> to hack it, just reinstall and patch - no threat to the real server.

If you are going to provide secure web access for email, then a slow machine
will not cut it, as SSL requires a significant amount of CPU power.  Though
if you have 3000 people checking email at once, then no single machine will
handle it anyway.

Also, if you are providing webmail access, then IMAP is certainly the way to
go, as it allows users to store mail on the server in folders.  SquirrelMail
is a good free webmail client that works with IMAP.

--
David Phillips <[email protected]>
http://david.acz.org/