search

PatchDashboard / patchdashboard

Patch Management Dashboard
Apache License 2.0
37 stars 16 forks source link

db_conf readable by all #2

Closed rndmh3ro closed 9 years ago

rndmh3ro commented 9 years ago

The following files are readable for all users on the host-system thus allowing anyone to see the password for the mysql-connection.

-rw-r--r-- 1 root root   68 Dec 27 14:15 /opt/patch_manager/db.conf
-rw-r--r-- 1 root root  441 Dec 27 14:15 /opt/patch_manager/db_config.php
jonsjava commented 9 years ago

The same data is web user readable in /WEB_PATH/lib/db_config.php

This is designed to run on a stand-alone server with only people who have access to the system on the sever itself. I will add that note in my documentation. Thank you for that info!

With that said, I can lock it down, but we are still looking at www-data/apache having the same read access to essentially the same data.