ispman/docs INSTALL,1.6,1.7

Update of /cvsroot/ispman/ispman/docs
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv7468/docs

Modified Files:
	INSTALL 
Log Message:
added appendixes

Index: INSTALL
===================================================================
RCS file: /cvsroot/ispman/ispman/docs/INSTALL,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -d -r1.6 -r1.7
--- INSTALL	1 Aug 2004 21:00:51 -0000	1.6
+++ INSTALL	2 Aug 2004 21:26:50 -0000	1.7
@@ -157,6 +157,7 @@
 (alternate targets:)
         -> make install-bin
         -> make install-web
+        -> make install-agent
 
 Notice:
 Every install target includes any necessary common files.
@@ -472,11 +473,94 @@
 
 Appendix: Security
 ==================
+There are several different security demands with ISPMan you
+should be aware of.
+
+a) ISPMan files:
+Requirements: 
+ * unix admin user should be able to use the CLI Tools (e.g. "admin")
+ * ispman-agent needs to execute ISPMan processes (this usualy must be
+   "root" to be able to create/chown directories) 
+ * web server needs to execute CGIs (running as "www" for example)
+ * ispman.conf contains cleartext passwords and thus must not be
+   readable by non-admin users
+
+To set up file permissions (regarding this example) correctly you
+should ...
+ - create a new group (e.g. "ispman") that contains all user ids using
+   ISPMan (here: admin, www)
+ - change group of all ISPMan files:
+        -> cd <installdir>
+        -> chgrp -R ispman .
+ - if you didn't do ISPMan install as root I suggest reowning all
+   files to root:
+        -> cd <installdir>
+        -> chown -R root .
+
+During the install process all file modes should already be set
+adequately. Basicall only one file is of greater concern, because it
+contains cleartext passwords -> ispman.conf.
+Be sure that this file will not be readable by non-admin users!
+        -> chmod 640 ispman.conf
+
+
+b) Web:
+Some users where claiming that ISPMan is unsecure, because ISPMan
+files (including ispman.conf) is readable by the webserver and thus
+any CGI programm a users calls could read those files.
+
+Although, this might be correct for some webserver installations, this
+is no security problem with ISPMan but rather the used webserver
+installation.
+There are established techiques for secure CGI execution in place
+(suexec, jails, etc.). With such configured properly, there is no
+security problem with ISPMan at all.
 
 
 Appendix: Distribution packaging
 ================================
+The new installation procedures allow easy creation of distribution
+packages.
+
+Simple example:
+You want to build a tar file which can be used to distribute the
+ispman-agent on all of your hosts. The ispman install dir should be
+placed in "/usr/local/ispman".
+
+Do this as follows:
+        -> configure --prefix=/usr/local/ispman
+        -> make
+
+Now we don't actually want to install the software in
+/usr/local/ispman only to build the tarball. So do this:
+        -> make install-agent DESTDIR=/tmp/install
+
+This will install the complete ISPMan tree necessary to run the agent
+in /tmp/install. Just tar it there and you have a nice little
+distribution package.
+
+
+Appendix: Customizations
+========================
+You may have the need to change some of the ISPMan files to fit your
+requirements. Especially the library (*.lib) and template (*.template)
+files are designed for individual customizations.
+
+If that's the case for you, it may be advantageous to plan a litte bit
+ahead.
+Most users go the greedy way and just change the required files in their
+installation directory. While this may be adequate for some quick
+tests, you should not do this on a permanent basis.
+On next ISPMan update you'll know why, because the upgrade will
+overwrite all your nice litte changes.
+
+So, what's the best practice for such changes:
+Well, it's easy! Apply your changes to the *source* directory, not the
+installation directory.
+This has some obvious advantages:
+ - Your customizations will persist cvs updates. In fact, any changes
+   in the same file will be merged, presumed it doesn't conflict with
+   your modifications.
+ - Any (upgrade) installation will already contain your modifications.
 
 
-Appendx: Customizations
-=======================
\ No newline at end of file



-------------------------------------------------------
This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com