June 2002 - Koha-devel - lists.koha-community.org

Re: [Koha-devel] [Bug 49] Z39.50 module makes too many connections to the dat...
by COURYHOUSE＠aol.com 01 Jul '02

01 Jul '02

"Running as root just to bypass a file security problem is a bad idea in my opinion." yes a totally evil idea! ed sharpe! > Subj:[Koha-devel] [Bug 49] Z39.50 module makes too many connections to the > database > Date:6/30/2002 10:46:29 PM US Mountain Standard Time > From:<A HREF="mailto:bugzilla-daemon@wilbur.katipo.co.nz">bugzilla-daemon(a)wilbur.katipo.co.nz</A> > To:<A HREF="mailto:koha-devel@lists.sourceforge.net">koha-devel(a)lists.sourceforge.net</A> > Sent from the Internet > > > > http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=49 > > > > > > ------- Additional Comments From am12(a)bolis.com 2002-07-01 17:45 ------- > It seems to me that running as root then changing user ID's has potential > for > creating unnecessary bugs or security holes. Running as root just to > bypass a > file security problem is a bad idea in my opinion. The script doesn't even > need > to write to /var/run. It only needs access to /var/run/koha, which can be > owned > by apache. > > I don't know the various tradeoffs, but potentially the script could be run > as > something other than root or apache, such as daemon. > > And just to reiterate, the whole issue of /var/log or /var/run is > Linux-specific, and doesn't apply directly to other Unix flavors. Leave > the > OS-specific items, including file ownership issues, in the shell scripts. > > The processz3950queue script itself should be as simple as possible. > >

1 0

[Bug 49] Z39.50 module makes too many connections to the database
by bugzilla-daemon＠wilbur.katipo.co.nz 01 Jul '02

01 Jul '02

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=49 ------- Additional Comments From am12(a)bolis.com 2002-07-01 17:45 ------- It seems to me that running as root then changing user ID's has potential for creating unnecessary bugs or security holes. Running as root just to bypass a file security problem is a bad idea in my opinion. The script doesn't even need to write to /var/run. It only needs access to /var/run/koha, which can be owned by apache. I don't know the various tradeoffs, but potentially the script could be run as something other than root or apache, such as daemon. And just to reiterate, the whole issue of /var/log or /var/run is Linux-specific, and doesn't apply directly to other Unix flavors. Leave the OS-specific items, including file ownership issues, in the shell scripts. The processz3950queue script itself should be as simple as possible. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

RE: [Koha-devel] authentication
by Nicholas Rosasco 30 Jun '02

30 Jun '02

I know there was comment of LDAP or some sort of not-at-all DB solution -- this might become more important in terms of performance, I'd think, if there was a lot of checking of ID and characteristics. (Esp. if we were to hang attributes/preferences on this). Just raising for discussion... Nick

2 1

Hello
by Nicholas Rosasco 30 Jun '02

30 Jun '02

Hello Karen (I hope you don't mind me calling you Karen) -- I'm Koha's documentation ...uh, wonk, I guess you'd say. I don't actually code for the project, but I am deeply involved -- in other words, I won't be whipping up new features to meet your needs(ie, if something is "make or break" for you to use the application, I'm not going to be the one to write it), but I do work closely with the project and am involved in creating the timetables for new features. I'm ready to try to answer whatever questions you have, and (hopefully) help you get a handle on wether or not Koha will be useful for you. Answering your "steps" question intelligently will probably require a little dialogue with you. As far as using it, that I can definitely answer along the way. In the process, at a request from the project, I'll be carbon-copying them as to our exchange -- they all are curious to see what's going on with new adopters. Nick Rosasco

1 0

[Fwd: Koha library]
by Chris Cormack 30 Jun '02

30 Jun '02

Hi guys If anyone wants to take a crack at answering this that would be cool. Otherwise Ill write up an answer after work today. Chris PS hope everyone who is still in the weekend is having a good one -----Forwarded Message----- > From: Karen Littlefield <karenlitt1(a)cox.net> > To: chris(a)katipo.co.nz, Karen Littlefield <klittle(a)mid-del.k12.ok.us> > Subject: Koha library > Date: 30 Jun 2002 16:53:34 -0500 > > Chris, I contacted Rosalie Blake about the possible use of the Koha > library in our district. She referred me to you. We are a distict of > 27 sites each of which have a library within. We are presently using > Chancery's Library Pro. We would like to move to a union type catalog > in our district. The Koha library idea seems like a great idea. Is > there a way we can use the product? What are the steps to doing so? I > am a librarian by training but now serve the district as the > Instructional Technology Coordinator. It is my job to train and locate > software that will benefit the students and staff of our district. I > look forward to hearing from you. > Karen Littlefield > Mid Del Schools, OK > klittle(a)mid-del.k12.ok.us > karenlitt1(a)cox.net > 405-737-4461 x294 > -- Chris Cormack chris(a)katipo.co.nz Programmer 025 500 789 Katipo Communications www.katipo.co.nz

2 2

RE: [Koha-devel] authentication
by Tonnesen Steve 30 Jun '02

30 Jun '02

On Sun, 30 Jun 2002, Nicholas Rosasco wrote: > I know there was comment of LDAP or some sort of not-at-all DB solution -- > this might become more important in terms of performance, I'd think, if > there was a lot of checking of ID and characteristics. (Esp. if we were to > hang attributes/preferences on this). Absolutely, the authentication used by the checkauthentication() routine could be configurable from within Koha just like branches and printers. Steve.

1 0

[Bug 58] New: typos
by bugzilla-daemon＠wilbur.katipo.co.nz 30 Jun '02

30 Jun '02

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=58 Summary: typos Product: Koha Version: unspecified Platform: Other URL: http://koha.org/installation/support.html Status: NEW Severity: normal Priority: P2 Component: www.koha.org AssignedTo: chris(a)katipo.co.nz ReportedBy: kraai(a)alumni.cmu.edu QAContact: koha-devel(a)lists.sourceforge.net In the first paragraph, `libraries' should not be capitalized. In the second, `to' is misspelled as `too'. And in the URL of Pat Eyler's e-mail address, `mailto:' should be prepended. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 49] Z39.50 module makes too many connections to the database
by bugzilla-daemon＠wilbur.katipo.co.nz 30 Jun '02

30 Jun '02

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=49 tonnesen(a)cmsd.bc.ca changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |ASSIGNED ------- Additional Comments From tonnesen(a)cmsd.bc.ca 2002-07-01 06:53 ------- Or how about if processz3950 runs as root, creates the pid file, then drops root privileges and runs as the apache user after that (with $>=$apacheuid; $<=$apacheuid). ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 49] Z39.50 module makes too many connections to the database
by bugzilla-daemon＠wilbur.katipo.co.nz 30 Jun '02

30 Jun '02

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=49 ------- Additional Comments From tonnesen(a)cmsd.bc.ca 2002-07-01 05:59 ------- As it stands, z3950launch.sh is run by root which runs z3950shell.sh as the apache user which then runs processz3950queue. Since the apache user won't have write access to /var/run, can I touch the file as root and chown to the apache user before launching z3950shell.sh? ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 49] Z39.50 module makes too many connections to the database
by bugzilla-daemon＠wilbur.katipo.co.nz 30 Jun '02

30 Jun '02

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=49 ------- Additional Comments From kraai(a)alumni.cmu.edu 2002-07-01 05:33 ------- For FHS compliance, the default PID file location should be /var/run, not /var/log. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0