Tackling the Security Tips page

[Ivan Ristic <iv...@gmail.com>]

Hi,

Two months ago Rich asked me to help with the Security Tips page and I
agreed. I subscribed to this list straight away but it was only a few
days ago that I started thinking about what needs to be done. (I fear
the delay may be indicative when it comes to my future performance,
but I will try to do better.) To help me understand the scope of the
problem of securing Apache, I created the Apache Security Model, which
I've just published:

http://www.apachesecurity.net/blog/Apache-Security-Model.png

I'd appreciate if you can take a moment to examine and comment on the model.

I will then draft the new Security Tips page, using the model as guidance.

-- 
Ivan Ristic

---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org

Re: Tackling the Security Tips page

[Rich Bowen <rb...@rcbowen.com>]

> Two months ago Rich asked me to help with the Security Tips page and I
> agreed. I subscribed to this list straight away but it was only a few
> days ago that I started thinking about what needs to be done. (I fear
> the delay may be indicative when it comes to my future performance,
> but I will try to do better.) To help me understand the scope of the
> problem of securing Apache, I created the Apache Security Model, which
> I've just published:
>
> http://www.apachesecurity.net/blog/Apache-Security-Model.png


Wow. That's comprehensive, and will be a HUGE leap up from the  
"security" documentation we have now. Thanks so much for putting your  
time into this worthy venture.

--Rich


--
Oh! I have slipped the surly bonds of earth
And danced the skies on laughter-silvered wings

Re: Tackling the Security Tips page

["William A. Rowe, Jr." <wr...@rowe-clan.net>]

Ivan Ristic wrote:
> Hi,
> 
> Two months ago Rich asked me to help with the Security Tips page and I
> agreed. I subscribed to this list straight away but it was only a few
> days ago that I started thinking about what needs to be done. (I fear
> the delay may be indicative when it comes to my future performance,
> but I will try to do better.) To help me understand the scope of the
> problem of securing Apache, I created the Apache Security Model, which
> I've just published:
> 
> http://www.apachesecurity.net/blog/Apache-Security-Model.png

This is an excellent illustration!

I'd flip Delegated Admin around to the left side of the tree.

Can you re-merge a fork for the logging+filesystem perms dual-entries?

If it's possible to clean up some of the crossovers, I'd say it's just
about there.

---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org