hey,
I thought this was a good place to drop my question, as I searched the entire board for how to protect the Members dir. I apologize in advance if you've answered this question before.
I need to know if 777 rights is absolutely necessary for the Members dir. I need to protect a 5.47d from Linux shell users viewing the password files. This is not about protecting from http or ftp clients. This is protecting it from ssh clients.
I'm a server administrator for several virtual hosts on one machine, one of which is a major UBB board with 5,000 registered users. Since this client is a not-for-profit site, they couldn't afford one machine robust enough, so they got some of their members to share the server. Hell, I'm a long-standing member too.
Question: If I must use 777 permissions, do you guys know of anyway to assign perl's "nobody" to the Members group, thus allowing me to reset permissions to 770. Actually I thought "nobody" was part of the "root" wheel, anyhow. So why do you say 777 is necessary?
I know, I know, I should just place this board on its own partition. But hey, I was too concerned about speed (the reason they came to me), so I focused on setting it up with its own apache instantiation. got surprised by the text-based passwords after it was too late....sigh.
Sorry I don't just experiment before bothering you, but this client's board easily has 100+ apache sessions going at once. One wrong test and my client gets emailed by 25-50 people.
