<br><font size=2 face="sans-serif">Nicky,</font>
<br>
<br><font size=2 face="sans-serif">What OS are we talking about? The
easy answer is to remove cvsweb.cgi, but if you don't want to do that,
make sure that your web server and rancid processes run with separate user
id's and that the two can not read each others files.</font>
<br>
<br><font size=2 face="sans-serif">Dan</font>
<br>
<br>
<br>
<p><font size=1 color=#800080 face="sans-serif">Sent by:
rancid-discuss-bounces@shrubbery.net</font>
<p><font size=1 color=#800080 face="sans-serif">To:
</font><font size=1 face="sans-serif">rancid-discuss@shrubbery.net</font>
<br><font size=1 color=#800080 face="sans-serif">cc:
</font><font size=1 face="sans-serif">(bcc: Dan Mitton/YD/RWDOE)</font>
<br><font size=1 color=#800080 face="sans-serif">Subject:
</font><font size=1 face="sans-serif">[rancid] No
Password required to read Configs.</font>
<div align=right>
<br><font size=1 face="sans-serif">LSN: </font><font size=1 color=#008000 face="sans-serif">Not
Relevant - Not Privileged</font>
<br><font size=1 face="sans-serif">User Filed as: </font><font size=1 color=blue face="sans-serif">Excl/AdminMgmt-14-4/QA:N/A</font>
<br></div>
<br><font size=3>Hi All,<br>
<br>
We have a Rancid installation on an internal IP. Everything is pretty
much default and only our Cisco devices are managed through Rancid.
I just noticed a truck sized hole in my config however. <br>
<br>
If you enter </font><a href="http://192.168.32.2/cgi-bin/cvsweb.cgi/"><font size=3 color=blue><u>http://192.168.32.2/cgi-bin/cvsweb.cgi/</u></font></a><font size=3>
on your browser, you can access the config files for all our devices without
a password.<br>
<br>
I have limited the IPs which can reach port 80 but that is far from enough.
What must I change to protect this data? Is there a howto?
Did I miss a section of the installation manual? <br>
<br>
Nicky.</font><tt><font size=2>_______________________________________________<br>
Rancid-discuss mailing list<br>
Rancid-discuss@shrubbery.net<br>
</font></tt><a href="http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss"><tt><font size=2>http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss</font></tt></a>
<br>
<br>