Numerous World Writeable Directories Post Install

[randomuser]

Hi,

We just started using DA, and I am familiarizing myself with it as much as possible.

I just did an install of DA on a VDS, and am currently in "poking around" mode. I have a bit to paste, but the questions are all pretty much the same --


1. "is directory ________ necessary, or can it be removed?", and

2. "what is the purpose of this directory?"


Post install, pre pretty much anything, I noticed the following directories are world writeable, and some have many world writeable subdirectories:

[root@host]# find / -perm 777 | grep -v "^/proc"

/usr/local/directadmin/customapache/curl-7.15.4
/usr/local/directadmin/customapache/gd-2.0.33
/usr/local/directadmin/customapache/libmcrypt-2.5.7
/usr/local/directadmin/customapache/mhash-0.9.1
/usr/local/directadmin/customapache/mod_perl-1.29/t/logs


My experience is with cPanel, and the best way I can think of to ask questions is by comparison. In cPanel, there are packages that are archived on the server for the purpose of on the fly installation without the necessity of having to download the package first. My question is: is that the purpose of the curl, gd, libmcrypt, mhash, and mod_perl directories above, or are they simply leftover from the DA install and can be safely removed?



[root@host]# find / -perm 1777 | grep -v "^/proc"

/var/spool/samba (can this be safely removed if Samba isn't going to be used?)

/var/spool/virtual (I searched the forums for this and came up empty handed. Can someone please tell me the purpose of this directory, and if it's critical to exist with world writeable permissions?)

/home/tmp (a forum search shows me this is configurable in directadmin.conf. Would it be reasonable to remove this directory and symlink it to /tmp? I don't see why not, but figure it's safer to ask first)


Thanks for any feedback and recommendations. I'm currently working with a test VDS, so I'm more than willing to experiment with changing things around, and if something breaks drastically I can always reinstall. So feel free to post any recommendations, even if they might make something break. I am looking forward to working with a much less buggy panel

On that note (and I searched around for this as well) -- does DA have bugzilla or a similiar bug reporting feature anywhere? Where are bug announcements made? Having cPanel's bugzilla and changelog on an RSS feed is a very nice way to stay on top of not only panel related issues, but sometimes even security related issues that pertain to scripts that can be installed via cPanel. Which reminds me, I don't think I've seen Fantastico as part of DA, or any other type of local package repository. I am liking DA more and more all the time.

 

[DirectAdmin Support]

Hello,

Regarding the 777 files in /usr/local/directadmin/customapache .. the DA installer only extracts the tar.gz files. No permissions are set by the DA installer. 777 is not likely required for these cases.

You can type:

./build clean

from the customapache directory to delete teh build data, and yes, you can remove the *.gz files. If you need them again, just run:

./build update

samba is not part of the DA install. If you are not running samba, then you can most likely remove it.

/var/spool/virtual is used for all of your email data. Files are written in it by different users, hence the chmod 1777. You can try it with just 755, but that may break it.

And yes, you can link /home/tmp to /tmp if you want, no problem with doing that. The original reason for it was how file uploads were handled. The tmp partition had to be on the same partition as the user's home so that the file could just be renamed. We've since changed how the files is moved, so the link should work just fine.

We have our versions system here:
http://www.directadmin.com/versions.php
It's used to keep track of all changes and bugs. Anyone who finds a bug should first check there before emailing us. We'll confirm it and then add it with possible workarounds until the fix is released.

John