Date: Mon, 27 Aug 2001 10:40:32 -0400 (EDT) From: Jim Sander <jim@federation.addy.com> Cc: BSD-ISP <freebsd-isp@FreeBSD.ORG> Subject: Re: Frontpage Extensions - security and reliability assessment Message-ID: <Pine.BSF.4.10.10108271020190.54880-100000@federation.addy.com> In-Reply-To: <3B8A4965.5484BA3B@buckhorn.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Ditto what others have been saying. We've got a few hundred FP-enabled sites running on FreeBSD, and relatively few problems. Security-wise, there's no way to know for sure since the code isn't public, but we haven't seen any real problems since the early days. (knock on wood!) Common sense seems to be enough to keep a reasonably secure system. Users here also have FTP and shell access to their FP-enabled accounts, so it is pretty easy for them to clobber things that FP expects to see. That (usually) won't totally hose their site, and (again usually) a simple uninstall and reinstall of the extensions fixes the problem. We tell people that if they want to do "advanced" things, they're probably better off without the extensions since most of those capabilities are trivially duplicated via CGI scripts anyway. One problem missed is that lots of the functionality of the FP server extensions is controlled by the FP client. For instance FP97, and early versions of FP98, by default create more restrictive .htaccess files than later versions- specifically not allowing the POST method everywhere. This can confuse people who don't understand such things (the likely users of FP) if you're also allowing them to use their own scripts. We've also seen problems related to the way FP2K handles sub-webs compared to FP98. (now you're allowed to have nested subwebs) If customers use both versions of FP (or for a short time after they upgrade) it can be a bit strange until they republish their entire web and all the subwebs. If you're supporting a heterogenous environment is a bit of a pain, especially from the aspect of documentation- but mostly people have moved to FP2K now I think. (and we'll see what happens with 2002 I guess) Mostly it's a question of FP not "playing well with others" - if you stick to supporting only the built-in FP stuff, you're OK. When you try to mix in your own complex CGI functions it can get interesting sometimes. Still, with care it's definitely possible- it just takes some hacking. Then there's the issue of ASP support- which of course is nonexistant. So certain things like the "Save to Database" form component won't work. That's probably the biggest hurdle- explaining that having the FrontPage extensions doesn't necessarily enable ASP scripting. -=Jim=- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.10.10108271020190.54880-100000>