Re: Recap

We really need to think about what we want to accomplish in the
configuration file. This may be one of the first things we may want to
tackle in any redesign efforts.  It will define the richness and fullness
of the product.

Over time, I have found some limitations in elegant ways to accomplish
unique security implementations to meet our business needs.  I think of
things like implied permissions from parent directories, user based
permissions, overrides to the anonymous,guest,real (and class permissions)
user stuff.

The format (xml or current reditions) probably make little difference.
The features we want to define the product with make all the difference.


Just my 2 cents....

ted keller


On Fri, 26 Aug 2005, Gregory A Lundberg wrote:

> > The grossest way to accomplish this would be to #ifdef certain codes.
>
> The best way would be port directories and a command-line switch
> such as "-I ports/Win32".  Then you just #include the filed you need
> and the include directory search finds the one needed for the platform.
>
> > My gut reaction to a GUI, especially Qt is to shudder over the ensuing
> > bloat.  If there is to be a GUI of some sort, it should be optional via
> > ./configure, not mandatory.  A GUI more than anything will have the
> > greatest impact, not just win32 support.
>
> My reaction to Qt is to shudder as well.  It's a huge package with a lot of
> features which I doubt we'd use.  But it's there and it's mature.
>
> >
> >>>   * use XML for the internal configuration file formats.
> >>
> >> I'm not sure I agree with that, though it likely would result in a
> >> configuration that's easily front-ended with a GUI and still satisfies
> >> my request above, so I would have very little to base any objection on
> >> (other than I've worked very little with XML and don't feel comfortable
> >> with it ...  does that even count?)
> >
> > I like my ftpaccess.  In fact, an XML version would balloon my 375KB
> > ftpaccess file, since I have things like this:
> >
> > ## Begin OttIX ACL
> > class   anon-ottix      anonymous               64.26.128.0/18
> > class   anon-ottix      anonymous               64.26.176.0/24
> > class   anon-ottix      anonymous               64.86.0.0/22
> > class   anon-ottix      anonymous               66.6.48.0/20
>
> > And my patch, adds this:
> >
> > timeout idle 1200 anon-ottix
> >
> > Now, how much more simple and elegant can I state that?
>
> <class="anon-ottix"  access=anonymous>
>     <timeout idle="1200">
>                 Special class for anonymous users from
>                 the OTTIX networks.  We want to ensure
>                 they have a longer idle timeout than other
>                 anonymous users.
>                                                  Start                End
>     <from cidr="64.26.128/18">  64.26.128.0     64.26.159.255
>     <from cidr="64.26.176/24">  64.26.176.0     64.26.176.255
>     <from cidr="64.86.0/22">      64.86.0.0         64.86.3.255
>     <from cidr="66.6.48/20">      66.6.48.0         66.6.64.255
> </class>
>