MOO-cows Mailing List Archive
[Prev][Next][Index][Thread]

RE: stupid newbie question

This might be a problem for other M*'s but it is not a problem for MOO's.  MOO's have no access to the file system except for the loading and dumping of the database core, which is fixed and unchangable at the time of loadup. Its only other connection mechanisms are the IP listener ports to which it is assigned, and if you have the appropriate #define enabled in the options.h file uncommented, then it will allow outbound connections, which are typically used for sending mail back to the users and/or connections to other moo's or other services.  As long as you don't have allow outbound connections uncommented in options.h, then there is no way for a stock unmodified MOO server to be used for security breakins of any sort that I can concieve.

If she's really that worried, then you could always set the MOO up to run under an ordinary account, (any standard user account, it does not need root access to execute, though it may need a special kind of IP port permission depending on the unix permissions and securities in effect on your site.)  and if you did want to run it under root access, (for no reason I could give you except perhaps for IP port restrictions needing root access on some machines when using a port number above 1023) you can always set it up using the chroot command to guarantee no access to any other part of the filesystem as well.  (Tho linux doesn't seem to have a 'chroot' command one could be whipped up in five minutes by your average C programmer.  MOO doesn't require any external programs to run, it's completely self contained.

----------
From:  Bill Lantry[SMTP:wfl38@sruvm.sru.edu]
Sent:  Thursday, February 08, 1996 11:37 PM
To:  MOO-Cows@parc.xerox.com
Subject:  stupid newbie question

OK, first message. I'm setting up a MOO. One member
of the CS dept is in strong opposition... very strong...
what can I do to

politically: quiet her fears

Technically: make the MOO secure

she's worried about breakins... and says MOOs are notorious
among sysops as security nightmares. After months of work
on my part to get the server acquired and running, she wants
it shut down and banned.

ps. it's running BSD with the Lambda core...

Thanks,

Bill

***********************************************************************

Dr. William F. Lantry
Chair, Educational Technology Committee
Department of English
Home | Subject Index | Thread Index