url="news://news.mozilla.org/netscape/public/mozilla/webtools"> netscape.public.mozilla.webtools</ulink> newsgroup. Without your discussions, insight, suggestions, and patches, this could never have happened.
netscape.public.mozilla.webtools</ULINK> newsgroup. Without your
</para>
discussions, insight, suggestions, and patches, this could never have happened.
</section>
</PARA>
</SECTION>
<SECTIONid="contributors">
<TITLE>Contributors</TITLE>
<PARA>
Thanks go to these people for significant contributions
to this documentation (in no particular order):
</PARA>
<PARA>
Zach Lipton (significant textual contributions),
Andrew Pearson,
Spencer Smith,
Eric Hanson,
Kevin Brannen,
</PARA>
</SECTION>
<SECTIONID="feedback">
<TITLE>Feedback</TITLE>
<PARA>
I welcome feedback on this document. Without your submissions and input,
this Guide cannot continue to exist. Please mail additions, comments, criticisms, etc.
to <EMAIL>barnboy@trilobyte.net</EMAIL>. Please send flames to
<EMAIL>devnull@localhost</EMAIL>
</PARA>
</SECTION>
<SECTIONID="translations">
<sectionid="contributors">
<TITLE>Translations</TITLE>
<title>Contributors</title>
<PARA>
<para>
The Bugzilla Guide needs translators!
Thanks go to these people for significant contributions to this
Please volunteer your translation into the language of your choice.
documentation (in no particular order):
If you will translate this Guide, please notify the members of the mozilla-webtools mailing list at
</para>
<email>mozilla-webtools@mozilla.org</email>. Since The Bugzilla Guide is also hosted on the
<para>
Linux Documentation Project, you would also do well to notify
Andrew Pearson, Spencer Smith, Eric Hanson, Kevin Brannen, Ron Teitelbaum
</PARA>
</para>
</SECTION>
</section>
<sectionid="feedback">
<title>Feedback</title>
<para>
I welcome feedback on this document. Without your submissions
and input, this Guide cannot continue to exist. Please mail
additions, comments, criticisms, etc. to
<email>barnboy@trilobyte.net</email>. Please send flames to
<email>devnull@localhost</email>
</para>
</section>
<sectionid="translations">
<title>Translations</title>
<para>
The Bugzilla Guide needs translators! Please volunteer your
translation into the language of your choice. If you will
translate this Guide, please notify the members of the
mozilla-webtools mailing list at
<email>mozilla-webtools@mozilla.org</email>, and arrange with
Matt Barnson to check it into CVS.
</para>
</section>
<!-- conventions used here (didn't want to give it a chapter of its own) -->
<!-- conventions used here (didn't want to give it a chapter of its own) -->
&conventions;
&conventions;
</chapter>
</CHAPTER>
<!-- Keep this comment at the end of the file
Local variables:
mode: sgml
<!-- Keep this comment at the end of the file
Local variables:
mode: sgml
sgml-omittag:t
sgml-shorttag:t
sgml-namecase-general:t
sgml-general-insert-case:upper
sgml-minimize-attributes:nil
sgml-always-quote-attributes:t
sgml-always-quote-attributes:t
sgml-indent-step:2
sgml-auto-insert-required-elements:t
sgml-indent-data:t
sgml-balanced-tag-edit:t
sgml-parent-document:Bugzilla-Guide\.sgml
sgml-exposed-tags:nil
sgml-exposed-tags:nil
sgml-general-insert-case:lower
sgml-indent-data:t
sgml-indent-step:2
sgml-local-catalogs:nil
sgml-local-catalogs:nil
sgml-local-ecat-files:nil
sgml-local-ecat-files:nil
sgml-doctype:"<!DOCTYPE chapter PUBLIC \"-//OASIS//DTD DocBook V4.1//EN\">"
The MySQL Privelege System</ULINK> until you can recite it from memory!</PARA>
<para><emphasis>There is no substitute for understanding the
<PARA>
tools on your system!</emphasis> Read <ulinkurl="http://www.mysql.com/documentation/mysql/bychapter/manual_Privilege_system.html"> The MySQL Privilege System</ulink> until you can recite it from memory!</para>
At the very least, ensure you password the "mysql -u root" account and the "bugs" account, establish grant
<para>
table rights (consult the Keystone guide in Appendix C: The Bugzilla Database for some easy-to-use details)
At the very least, ensure you password the "mysql -u root"
that do not allow CREATE, DROP, RELOAD, SHUTDOWN, and PROCESS for user "bugs". I wrote up the Keystone
account and the "bugs" account, establish grant table
advice back when I knew far less about security than I do now : )
rights (consult the Keystone guide in Appendix C: The
</PARA>
Bugzilla Database for some easy-to-use details) that do
</LISTITEM>
not allow CREATE, DROP, RELOAD, SHUTDOWN, and PROCESS for
<LISTITEM>
user "bugs". I wrote up the Keystone advice back when I
<PARA>
knew far less about security than I do now : )
Lock down /etc/inetd.conf. Heck, disable inet entirely on this box. It should only listen to
</para>
port 25 for Sendmail
</listitem>
<listitem>
<para>
Lock down /etc/inetd.conf. Heck, disable inet entirely on
this box. It should only listen to port 25 for Sendmail
and port 80 for Apache.
and port 80 for Apache.
</PARA>
</para>
</LISTITEM>
</listitem>
<LISTITEM>
<listitem>
<PARA>Do not run Apache as "nobody". This will require very lax permissions in your Bugzilla directories.
<para>
Run it, instead, as a user with a name, set via your httpd.conf file.</PARA>
Do not run Apache as <quote>nobody</quote>. This will
</LISTITEM>
require very lax permissions in your Bugzilla directories.
<LISTITEM>
Run it, instead, as a user with a name, set via your
<PARA>
httpd.conf file.
Ensure you have adequate access controls for the $BUGZILLA_HOME/data/ and
<note>
$BUGZILLA_HOME/shadow/ directories, as well as the $BUGZILLA_HOME/localconfig and
<para>
$BUGZILLA_HOME/globals.pl files.
<quote>nobody</quote> is a real user on UNIX systems.
The localconfig file stores your "bugs" user password,
Having a process run as user id <quote>nobody</quote>
which would be terrible to have in the hands
is absolutely no protection against system crackers
of a criminal, while the "globals.pl" stores some default information regarding your
versus using any other user account. As a general
installation which could aid a system cracker.
security measure, I recommend you create unique user
In addition, some files under $BUGZILLA_HOME/data/ store sensitive information, and
ID's for each daemon running on your system and, if
$BUGZILLA_HOME/shadow/ stores bug information for faster retrieval. If you fail to secure
possible, use "chroot" to jail that process away from
these directories and this file, you will expose bug information to those who may not
the rest of your system.
be allowed to see it.
</para>
</PARA>
</note>
<NOTE>
</para>
<PARA>
</listitem>
Bugzilla provides default .htaccess files to protect the most common Apache
<listitem>
installations. However, you should verify these are adequate according to the site-wide
<para>
security policy of your web server, and ensure that the .htaccess files are
Ensure you have adequate access controls for the
allowed to "override" default permissions set in your Apache configuration files.
$BUGZILLA_HOME/data/ and $BUGZILLA_HOME/shadow/
Covering Apache security is beyond the scope of this Guide; please consult the Apache
directories, as well as the $BUGZILLA_HOME/localconfig and
documentation for details.
$BUGZILLA_HOME/globals.pl files. The localconfig file
</PARA>
stores your "bugs" user password, which would be terrible
<PARA>
to have in the hands of a criminal, while the "globals.pl"
If you are using a web server that does not support the .htaccess control method,
stores some default information regarding your
<EMPHASIS>you are at risk!</EMPHASIS> After installing, check to see if you can
installation which could aid a system cracker. In
view the file "localconfig" in your web browser (ergo:
addition, some files under $BUGZILLA_HOME/data/ store
sensitive information, and $BUGZILLA_HOME/shadow/ stores
http://bugzilla.mozilla.org/localconfig</ULINK>. If you can read the contents of this
bug information for faster retrieval. If you fail to
file, your web server has not secured your bugzilla directory properly and you
secure these directories and this file, you will expose
must fix this problem before deploying Bugzilla. If, however, it gives you a
bug information to those who may not be allowed to see it.
"Forbidden" error, then it probably respects the .htaccess conventions and you
</para>
are good to go.
<note>
</PARA>
<para>
</NOTE>
Bugzilla provides default .htaccess files to protect the
<PARA>
most common Apache installations. However, you should
On Apache, you can use .htaccess files to protect access to these directories, as outlined
verify these are adequate according to the site-wide
in <ULINKURL="http://bugzilla.mozilla.org/show_bug.cgi?id=57161">Bug 57161</ULINK> for the
security policy of your web server, and ensure that the
localconfig file, and <ULINKURL="http://bugzilla.mozilla.org/show_bug.cgi?id=65572">
.htaccess files are allowed to "override" default
Bug 65572</ULINK> for adequate protection in your data/ and shadow/ directories.
permissions set in your Apache configuration files.
</PARA>
Covering Apache security is beyond the scope of this
<PARA>
Guide; please consult the Apache documentation for
Note the instructions which follow are Apache-specific. If you use IIS, Netscape, or other
details.
non-Apache web servers, please consult your system documentation for how to secure these
</para>
files from being transmitted to curious users.
<para>
</PARA>
If you are using a web server that does not support the
<PARA>
.htaccess control method, <emphasis>you are at
Place the following text into a file named ".htaccess", readable by your web server,
risk!</emphasis> After installing, check to see if
in your $BUGZILLA_HOME/data directory.
you can view the file "localconfig" in your web browser
<LITERALLAYOUT>
(e.g.: <ulinkurl="http://bugzilla.mozilla.org/localconfig"> http://bugzilla.mozilla.org/localconfig</ulink>). If you can read the contents of this file, your web server has not secured your bugzilla directory properly and you must fix this problem before deploying Bugzilla. If, however, it gives you a "Forbidden" error, then it probably respects the .htaccess conventions and you are good to go.
<Files comments>
</para>
allow from all
</note>
</Files>
<para>
deny from all
On Apache, you can use .htaccess files to protect access
</LITERALLAYOUT>
to these directories, as outlined in <ulinkurl="http://bugzilla.mozilla.org/show_bug.cgi?id=57161">Bug 57161</ulink> for the localconfig file, and <ulinkurl="http://bugzilla.mozilla.org/show_bug.cgi?id=65572"> Bug 65572</ulink> for adequate protection in your data/ and shadow/ directories.
</PARA>
</para>
<PARA>
<para>
Place the following text into a file named ".htaccess", readable by your web server,
Note the instructions which follow are Apache-specific.
in your $BUGZILLA_HOME/ directory.
If you use IIS, Netscape, or other non-Apache web servers,
<LITERALLAYOUT>
please consult your system documentation for how to secure
<Files localconfig>
these files from being transmitted to curious users.
deny from all
</para>
</Files>
<para>
allow from all
Place the following text into a file named ".htaccess",
</LITERALLAYOUT>
readable by your web server, in your $BUGZILLA_HOME/data
<entry><foreignphrase>Prompt</foreignphrase> of users command under bash shell</entry>
<entry>bash$</entry>
<entry>bash$</entry>
</row>
</row>
<row>
<row>
<entry>
<entry><foreignphrase>Prompt</foreignphrase> of root users command under bash shell</entry>
Root user's prompt under bash shell</entry>
<entry>bash#</entry>
<entry>bash#</entry>
</row>
</row>
<row>
<entry><foreignphrase>Prompt</foreignphrase> of user command under tcsh shell</entry>
<entry>tcsh$</entry>
</row>
<row>
<row>
<entry>
<entry>Environment Variables</entry>
Normal user's prompt under tcsh shell</entry>
<entry><envar>VARIABLE</envar></entry>
<entry>tcsh$</entry>
</row>
</row>
<row>
<row>
<entry>Environment variables</entry>
<entry>Emphasized word</entry>
<entry><emphasis>word</emphasis></entry>
<entry>
<envar>VARIABLE</envar>
</entry>
</row>
</row>
<row>
<row>
<entry>Term found in the glossary</entry>
<entry>Code Example</entry>
<entry><programlisting><sgmltagclass="starttag">para</sgmltag>Beginning and end of paragraph<sgmltagclass="endtag">para</sgmltag></programlisting></entry>
Install <ulinkurl="http://www.activestate.com/">ActivePerl</ulink> for Windows. Check <ulinkurl="http://aspn.activestate.com/ASPN/Downloads/ActivePerl/">http://aspn.activestate.com/ASPN/Downloads/ActivePerl</ulink> for a current compiled binary.
<PARA>
</para>
<para>
Please also check the following links to fully understand the status
Please also check the following links to fully understand the status
Your configuration file for MySQL <EMPHASIS>must</EMPHASIS> be named C:\MY.CNF.
You can download MySQL for Windows NT from <ulink
</PARA>
url="http://www.mysql.com/">MySQL.com</ulink>. Some find it helpful to use the WinMySqlAdmin utility, included with the download, to set up the database.
and the CPAN Net::SMTP Perl module (available in .ppm).
and the CPAN Net::SMTP Perl module (available in .ppm).
Every option requires some hacking of the Perl scripts for Bugzilla
Every option requires some hacking of the Perl scripts for Bugzilla
to make it work. The option here simply requires the least.
to make it work. The option here simply requires the least.
</PARA>
</para>
</NOTE>
</note>
<PARA>
Download NTsendmail, available from<ULINKURL="http://www.ntsendmail.com/">
<procedure>
www.ntsendmail.com</ULINK>. In order for it to work, you must set up some
<step>
new environment variables (detailed on the ntsendmail home page). Figuring
<para>
out where to put those variables is left as an exercise for the reader.
Download NTsendmail, available from<ulink
You must have a "real" mail server which allows you to relay off it
url="http://www.ntsendmail.com/"> www.ntsendmail.com</ulink>. You must have a "real" mail server which allows you to relay off it in your $ENV{"NTsendmail"} (which you should probably place in globals.pl)
in your $ENV{"NTsendmail"} (which you should probably place in globals.pl)
</para>
</PARA>
</step>
<PARA>
Once downloaded and installed, modify all open(SENDMAIL) calls to open
<step>
"| c:\ntsendmail\ntsendmail -t" instead of "|/usr/lib/sendmail -t".
<para>Put ntsendmail.pm into your .\perl\lib directory.</para>
</PARA>
</step>
<NOTE>
<PARA>
<step>
We need someone to test this and make sure this works as advertised.
<para>Add to globals.pl:</para>
</PARA>
<programlisting>
</NOTE>
# these settings configure the NTsendmail process
</STEP>
use NTsendmail;
<STEP>
$ENV{"NTsendmail"}="your.smtpserver.box";
<PARA>
$ENV{"NTsendmail_debug"}=1;
Modify globals.pl and CGI.pl to remove the word "encrypt".
$ENV{"NTsendmail_max_tries"}=5;
</PARA>
</programlisting>
<NOTE>
<note>
<PARA>
<para>
I'm not sure this is all that is involved to remove crypt. Any
Some mention to also edit
NT Bugzilla hackers want to pipe up?
<varname>$db_pass</varname> in
</PARA>
<filename>globals.pl</filename> to be your
</NOTE>
<quote>bugs_password</quote>. Although this may get
</STEP>
you around some problem authenticating to your
<STEP>
database, since globals.pl is not normally
<PARA>
restricted by <filename>.htaccess</filename>, your
Change all references to "processmail" to "processmail.pl" in
database password is exposed to whoever uses your
all files, and rename "processmail" to "processmail.pl"
web server.
</PARA>
</para>
<NOTE>
</note>
<PARA>
</step>
I really think this may be a change we want to make for
<step>
<para>
Find and comment out all occurences of
<quote><command>open(SENDMAIL</command></quote> in
your Bugzilla directory. Then replace them with:
<programlisting>
# new sendmail functionality
my $mail=new NTsendmail;
my $from="bugzilla\@your.machine.name.tld";
my $to=$login;
my $subject=$urlbase;
$mail->send($from,$to,$subject,$msg);
</programlisting>
</para>
<note>
<para>The code above needs testing as well to make sure it is correct.</para>
</note>
</step>
</procedure>
</step>
<step>
<para>
Change all references in all files from
<filename>processmail</filename> to
<filename>processmail.pl</filename>, and
rename <filename>processmail</filename> to
<filename>processmail.pl</filename>.
</para>
<note>
<para>
Many think this may be a change we want to make for
main-tree Bugzilla. It's painless for the UNIX folks,
main-tree Bugzilla. It's painless for the UNIX folks,
and will make the Win32 people happier.
and will make the Win32 people happier.
</PARA>
</para>
</NOTE>
</note>
</STEP>
<note>
<STEP>
<para>
<PARA>
Some people have suggested using the Net::SMTP Perl module instead of NTsendmail or the other options listed here. You can change processmail.pl to make this work.
Modify the path to perl on the first line (#!) of all files
<programlisting>
to point to your Perl installation, and
<![CDATA[
add "perl" to the beginning of all Perl system calls that
use a perl script as an argument. This may take you a while.
my $smtp = Net::SMTP->new('<NameofyourSMTPserver>'); #connect to SMTP server
There is a "setperl.pl" utility to speed part of this procedure,
$smtp->mail('<yourname>@<yousmptserver>');# use the sender's adress here
available in the "Patches and Utilities" section of The Bugzilla Guide.
$smtp->to($tolist); # recipient's address
</PARA>
$smtp->data(); # Start the mail
</STEP>
$smtp->datasend($msg);
<STEP>
$smtp->dataend(); # Finish sending the mail
<PARA>
$smtp->quit; # Close the SMTP connection
In processmail.pl, add "binmode(HANDLE)" before all read() calls.
$logstr = "$logstr; mail sent to $tolist $cclist";
This may not be necessary, but in some cases the read() under
}
Win32 doesn't count the EOL's without using a binary read().
</PARA>
]]>
</STEP>
</programlisting>
</PROCEDURE>
here is a test mail program for Net::SMTP:
<programlisting>
<
