On Friday, December 09, 2011 07:49:13 AM Grant wrote: > >> I ran squirrelmail/configtest.php and realized I don't have an > >> attachment directory set up for Squirrelmail: > >> > >> ERROR: Attachment dir (/var/local/squirrelmail/attach/) does not > >> exist! > >> > >> I don't even have a /var/local/. Would a good Gentoo'er create the > >> directory in that location? > > > > If a website needs to write files, let it do so under its own directory > > hierarchy. All of our PHP sites have something equivalent to the > > following in their apache vhost configs: > > > > php_admin_value open_basedir /var/www/example.com/www/ > > php_admin_value upload_tmp_dir /var/www/example.com/www/tmp > > php_admin_value session.save_path /var/www/example.com/www/tmp > > > > That way, if www.example.com is compromised, the rest of the machine is > > still safe (barring PHP bugs). > > There is a Squirrelmail document recommending that the Squirrelmail > data and attachments directories are established outside of the web > server's reach. /var is given as an example. They also recommend > root:apache 0730 for both directories. > > This is a little disturbing because my Squirrelmail data directory was > created under the webroot as apache:apache 0755 at some point. Would > this have been done by Gentoo? Should I file a bug? > > "Prepare data and attachment directories" > http://squirrelmail.org/docs/admin/admin-3.html > > - Grant
I think the data-directory is included from upstream and is there to have it work when installing it "blindly". Recommendations are not always possible (think hosted environments) -- Joost
