15 Aug
2009
15 Aug
'09
10:19 a.m.
Hi Trevor,
On Aug 15, 2009, at 2:34 AM, Trevor wrote:
Hello,
1. I am wondering if any users running XWiki on Tomcat 5.5 have set
up a SecurityManager policy. The documentation isn't really clear
on this, other than "it's an issue" that may not be resolved. The
one "comment" on XWiki.org that has a security policy is close but
not quite clear. I couldn't figure out the part about Log4J.
- is a policy necessary?
- without one, are there any inherent security risks using XWiki/
Tomcat "out of the box"?
- what about Tomcat's default "users" and "roles"?
It really depends on your IT security rules. XWiki needs a few things
to work:
- ability to create threads
- ability to access files from the filesystem (for caches and to write
the xwiki log file)
So in general we don't run XWiki with any security manager.
From a user POV only groovy scripting can access files on the
filtesystem and do dangerous things. This is why we have a special
right called programming right that is required for groovy scripting
and that you should only give to trustworthy people (admins in general).
2. Are there any security risks using the default
"xwiki"
installation location in webapps? ie. if it's there and someone
realizes you're running XWiki, couldn't they then direct their
attacks specifically at MySQL / Tomcat / XWiki, looking for holes?
There are some known security issues at various level that we usually
fix (like injection issues). Some not so serious issues exist but we
haven't published them till they are solved.
I tried installing the WAR to a different location,
and failed
miserably. Does it matter?
No idea what you call location. Location doesn't matter in general and
you don't even need to be root to install xwiki.
3. Is anyone using XWiki over SSL? Anything special we need to do
for that, other than getting a certificate?
As you can tell, I'm not familiar with Tomcat and not a security
guru. I'm just the one who has to make sure our setup "out of the
box" is secure against exploits.
We're running on Ubuntu, with MySQL. Yes, the server will be behind
a firewall, and the MySQL passwords have been changed.
I think what would help in the online documentation is a "security
checklist" that rounds up all the various bits that I found on
various pages.
I'm not a security expert either. You could consider hiring a xwiki
security expert to review your setup if it's important to you. You
could try contacting http://xwiki.com if you don't get enough answer
here or if you want some validation.
Thanks
-Vincent