76156 - Securing Bugzilla section omits shadow directory.

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect)

Description

[Matthew Tuck [:CodeMachine]]

While the Securing Bugzilla section does talk about securing the shadow
directory, it is missing in this sentence:

Ensure you have adequate access controls for $BUGZILLA_HOME/data/ and
$BUGZILLA_HOME/localconfig. The localconfig file stores your "bugs" user
password, which would be terrible to have in the hands of a criminal. Also some
files under $BUGZILLA_HOME/data store sensitive information.

Comment 1

[Jacob Steenhagen]

Hmmm... that's in the README (not those exact words, but the idea).  Perhaps
that'll just have to be one of the things that gets merged as part of bug 76841.

Comment 2

[Matthew Tuck [:CodeMachine]]

Tara is deprecating the README for 2.12 ... the Bugzilla Guide should be
correct.

Comment 3

[Dave Miller [:justdave]]

Currently in the README:

There are two critical directories and a file that should not be a served by
the HTTP server. These are the 'data' and 'shadow' directories and the
'localconfig' file. You should configure your HTTP server to not serve
content from these files.  Failure to do so will expose critical passwords
and other data. Please see your HTTP server configuration manual on how
to do this.

Comment 4

[Dave Miller [:justdave]]

Changed that paragraph in README to:

> There are two critical directories and a file that should not be a served by
> the HTTP server. These are the 'data' and 'shadow' directories and the
> 'localconfig' file. You should configure your HTTP server to not serve
> content from these files. Failure to do so will expose critical passwords
> and other data. Please see your HTTP server configuration manual on how
> to do this. If you use quips (at the top of the buglist pages) you will want
> the 'data/comments' file to still be served. This file contains those quips.

Comment 5

[Matthew Tuck [:CodeMachine]]

Barnboy, this is a pretty small but important change.  Is there any chance of
getting 5 minutes of your time on this one before 2.12?

Comment 6

[Matthew Barnson]

No problem.
I'll try to have this and the other 2.12 bugs finished by Tuesday afternoon 
this week.

Comment 7

[Matthew Tuck [:CodeMachine]]

This is the final 2.12 issue.  Please let us know if you can't do this soon for 
whatever reason.

Comment 8

[Matthew Barnson]

For those of you waiting with baited breath, I'm getting this and the last few
bugs in the Guide finished now.  Today is Tuesday, and it's the afternoon.  I'll
have it in shortly!

Comment 9

[Matthew Barnson]

Fixed and checked in.

Comment 10

[Dave Miller [:justdave]]

Moving closed bugs to Bugzilla product