On 11/7/05, <b class="gmail_sendername">Adam Chlipala</b> <<a href="mailto:adamc@hcoop.net">adamc@hcoop.net</a>> wrote:<div><span class="gmail_quote"></span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
I don't think anyone has replied to this, so I'm not going to change<br>anything about our set-up for now.<br></blockquote></div><br>
I was thinking about the argument of a DoS attack. We allow ssh to
hcoop. So an attacker can ssh as root and take over the entire server.
That is a bigger security vunerability.<br>
What makes it secure is that its password protected. So how about
allowing uploads etc., only from password protected applications. The
user would have to register his/her application with hcoop. Another
thing which could be done is limit the number of apache child
processes/user. this way a DoS with thousands of running processes
could be prevented. <br>
We could also impose a blanket cap of 200 script(Or any arbit number
fydor can handle). This way also we can stop such an attack.<br>