DO's and DON'Ts about using gpg on the internet?
Fri Jan 25 10:32:01 2002
On Thu, 24 Jan 2002 11:55:55 -0600, David said:
> Q1. How secure is the setuid when run through a cgi script. I suppose
> this is os and version number dependent. Comments on this is
It is pretty secure becuase the privs are dropped very early. OTOH,
there is no need to lock memory pages because your threat model is
different. It only makes sense if someone can root access and in this
case you are doomed anyway or an attacker das phsical access to the
machine which is also unlikely for a server.
> Q2. The public key ring is best owned by root. Is this true?
It is always a good idea not to give write access to the CGI user, I'd
create an extra user for this.
Werner Koch Omnis enim res, quae dando non deficit, dum habetur
g10 Code GmbH et non datur, nondum habetur, quomodo habenda est.
Privacy Solutions -- Augustinus