[Xitami] HELP! web based admin problem?

[Ewen McNeill]

In message <03df01c1d5e5$02eae4a0$020aa8c0@Master>, "Russel Olinger" writes:
>I just posted my server live and I am hosting 8 different Vitual 
>Domains.  I want each domain to have the ability to administer itself 
>and nothing else.  However, when I go to the /admin for each domain they 
>all have full access to all admin privelages to ALL domains.  Big 
>security problem, obviously.

/admin is administration of the _whole_server_.  It should be restricted
to people that you trust.  It's typically accessible automatically under
each domain name, by default.  But you _may_ be able to turn it off on a
domain-by-domain basis (I can't remember if the code checks this at the
right place for that to work).

Generally it'd be best not to allow anyone you don't trust running
anything they like on your server access to /admin, because with /admin
access they can set it up to let them run any program they like on your
server.

Most places I've worked configuration of the webserver (rather than just
uploading content) is restricted to a single webserver admin.  And they
double check things for security reasons, etc, before adding new setups.

Ewen

-- 
Ewen McNeill, Technical Consultant, iMatix Corporation  www.imatix.com