DO's and DON'Ts about using gpg on the internet?

[Werner Koch]

On Thu, 24 Jan 2002 11:55:55 -0600, David  said:

> Q1. How secure is the setuid when run through a cgi script. I suppose
> this is os and version number dependent.  Comments on this is
> appreciated.

It is pretty secure becuase the privs are dropped very early.  OTOH,
there is no need to lock memory pages because your threat model is
different.  It only makes sense if someone can root access and in this
case you are doomed anyway or an attacker das phsical access to the
machine which is also unlikely for a server.

> Q2. The public key ring is best owned by root. Is this true?

It is always a good idea not to give write access to the CGI user, I'd
create an extra user for this.


-- 
Werner Koch        Omnis enim res, quae dando non deficit, dum habetur
g10 Code GmbH      et non datur, nondum habetur, quomodo habenda est.
Privacy Solutions                                        -- Augustinus