From: eldy <> Date: Tue, 4 Feb 2003 01:20:43 +0000 (+0000) Subject: Updated documentation. X-Git-Tag: AWSTATS_5_4_BETA~12 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=354d725fcd6138cc6c2c60e13a4e4c3a31b8e9fc;p=thirdparty%2FAWStats.git Updated documentation. --- diff --git a/docs/awstats.pdf b/docs/awstats.pdf index 699c6b5b..e68a2e61 100644 Binary files a/docs/awstats.pdf and b/docs/awstats.pdf differ diff --git a/docs/awstats_security.html b/docs/awstats_security.html index e605623b..11322f8e 100644 --- a/docs/awstats_security.html +++ b/docs/awstats_security.html @@ -58,41 +58,10 @@ If users have a command line access (telnet) on statistics server, you must set database files. Set all AWStats database files (built by the update process) for config/domain1 to have read/write for user1 (or an admin user) and NO read and NO write permissions for any other users.
Then, check that the SaveDatabaseFilesWithPermissionsForEveryone parameter is set 0 in your config/domain files.
-If AWStats database files for config/domain1 are read protected, only allowed users can see statistics for config/domain1.
-If AWStats database files for config/domain1 are write protected, only allowed users can update statistics for config/domain1.
+If AWStats database files/directory for config/domain1 are read protected, only allowed users can see statistics for config/domain1.
+If AWStats database files/directory for config/domain1 are write protected, only allowed users can update statistics for config/domain1.


- -

2) MEDIUM SECURED POLICY


Policy:
You have several config/domain and several users. You want to specify which user can see or update dynamically @@ -126,19 +95,27 @@ To known how to create a protected realm for servers other than Apache, see your Then edit each config/domain file you want to be protected to set AllowAccessFromWebToAuthenticatedUsersOnly to 1.
You can also edit list of authorized users in the AllowAccessFromWebToFollowingAuthenticatedUsers parameter.
You can also specify a range of allowed browsers IP Addresses with the AllowAccessFromWebToFollowingIPAddresses parameter.
+ +You can also set SaveDatabaseFilesWithPermissionsForEveryone parameter to 0 in all config/domain files, +except if you want to allow update from web with option AllowToUpdateStatsFromBrowser=1. But this is +not recommanded as you need to give read/write permission for Web server user on all history +files (Except if you setuid AWStats script for each authorized user, but this make setup much harder).
The following parameters ErrorMessages and DebugMessages are -also related to security parameters.
+also parameters related to security.
+

Other tip: If the AWSTATS_FORCE_CONFIG environment variable is defined, AWStats will always use the config file awstats.VALUE_OF_AWSTATS_FORCE_CONFIG.conf as the config/domain file. So if you add this environment variable into your web server environment, for example by adding the line
SetEnv AWSTATS_FORCE_CONFIG configvalueforthisdomain
-with other directives in your Apache <VirtualHost> directive group in httpd.conf), AWStats will use the config file +in your Apache <VirtualHost> directive group in httpd.conf (with other directives), AWStats will use the config file called awstats.configvalueforthisdomain.conf to choose which statistics used, even if a visitor try to force the config/domain file with the URL 'http://mydomain/cgi-bin/awstats.pl?config=otherdomain'. This might be usefull for thoose who edit their config/domain file with AllowAccessFromWebToFollowingAuthenticatedUsers="__REMOTE_USER__" -instead of maintaning the list of authorized users into each AWStats config file.
-

+instead of maintaining the list of authorized users into each AWStats config file.
+
+
+

3) NO SECURITY POLICY


Policy:
@@ -156,8 +133,8 @@ to have a minimum of security).


-There is a lot of possible use for AWStats combining all its options/parameters with all web servers options/parameters. -Just use the one you need...
+There is a lot of possible use for AWStats combining all its options/parameters with all web servers options/parameters and operating +systems security features. Just use the one you need...