OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Apache ap_getpass vulnerability
From: Carson Gaspar (carsonTALTOS.ORG)
Date: Sat Nov 04 2000 - 23:28:51 CST

--On Saturday, November 04, 2000 6:36 PM +0200 Peter Pentchev
<roamORBITEL.BG> wrote:

> You mean you're writing an Apache module that reads user input at
> the time the server is starting?.. Does this mean that the server
> startup itself becomes interactive? This pretty much rules out
> unattended Apache startup - you need to start the server manually
> each time it dies; also, it cannot be put in the system's startup
> scripts. IMHO, this is not such a good idea :(

Having your private key stored un-encrypted on disk is also a really bad
idea. You have to decide how you're going to trade-off operational
complexity vs. security. 

--
Carson Gaspar -- carsontaltos.org
Queen Trapped in a Butch Body