linuxaudio.org

On 04/26/2012 05:47 PM, Robin Gareus wrote:

quoted text
> Hi *,

>

> There's a whole lot of v-hosts below linuxaudio.org. The recent

> migration of vhosts gave rise to rethink and hopefully consolidate others.

>

> Let me first list the "good ones" and them move on to suggestions for

> the cruft. Please comment on my suggestions there. If you don't, you

> forfeit your right to complain later :-)

i'm with you on all items, but want to comment on this one:
> http://stats.linuxaudio.org/

quoted text
>    server statistics

>    ?? should those be password protected ??

>    some of the AWstats may be used to track users (e.g. top 10 host list)

been running awstats for ages because its output is great, but it's a

security nightmare. i've taken to displaying only static pages generated

from a cronjob every hour. not as convenient, and makes browsing of

previous years a lot harder, but there have been soo many XSS attacks

and other gotchas in the past...
imho, it's either that or password-protect it. my logs show numerous

automated scans for vulnerable awstats implementations.
--

Jörn Nettingsmeier

Lortzingstr. 11, 45128 Essen, Tel. +49 177 7937487
Meister für Veranstaltungstechnik (Bühne/Studio)

Tonmeister VDT
http://stackingdwarves.net
_______________________________________________

Consortium mailing list

Consortium@lists.linuxaudio.org

http://lists.linuxaudio.org/listinfo/consortium