Date: Mon, 21 Jan 2002 18:27:36 -0800
From: Emanuel Borsboom <em@nuel.ca>
To: gopher@complete.org
Subject: [gopher] Re: Security issues in Gopher?
Message-ID: <20020121182736.D10244@siva.heatdeath.org>
Mail-Followup-To: gopher@complete.org
References: <87pu43g046.fsf@complete.org>
 <DDDDD43B-0ED9-11D6-9A05-003065663F8C@golden.net>
Mime-Version: 1.0
Content-type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <DDDDD43B-0ED9-11D6-9A05-003065663F8C@golden.net>;
 from rhahn@golden.net on Mon, Jan 21, 2002 at 08:46:34PM -0500
Content-Transfer-Encoding: 8bit
Sender: gopher-bounce@complete.org
Errors-to: gopher-bounce@complete.org
Precedence: bulk
Reply-to: gopher@complete.org


> can't really do a whole lot of damage) so I'm wondering what it
> would take for me to run gopherd as nobody - and better still, why
> people are running it as root.

I have it running as nobody and it works just fine.  I use this syntax
to start it:

/usr/local/sbin/gopherd -l /usr/local/var/log/gopherd.log -u nobody /usr/local/var/gopher-data 70

This is with an older version of gopherd, YMMV.

It's pretty safe to run gopherd as root because it chroots to your
data directory.  I preferred not to do this, though, because I wanted
to write the log elsewhere.

-- 
Emanuel Borsboom
http://www.nuel.ca/