Unfinished comments (cropped or forgotten) in backend/config.py.

[awwad]

https://github.com/SeattleTestbed/clearinghouse/blob/master/backend/config.py contains comments intended to explain in brief the reason for the recommended permissioning of certain files, but the comment is cut off prematurely, mid-sentence:

"The reason for the restrictions is explained in backend_daemon.py, but
basically it's that we want the backend to be the place where all node-"

[awwad]

Also, I don't see any such explanation in backend_daemon.py.

[aaaaalbert]

Okay, this is an interesting find! The comment in config.py was checked in originally like this.

There is some doc on the backend scripts:

• https://seattle.poly.edu/wiki/SeattleBackend
• https://seattle.poly.edu/wiki/SeattleGeniDesign ("clearinghouse" was called "SeattleGeni" before)

[awwad]

That's useful, thank you; I think I've learned from those.

However, none of those documents explain the need for the apache user to
not have access to particular config files, which the missing comment would
have explained.

On Fri, Oct 16, 2015 at 5:02 AM aaaaalbert notifications@github.com wrote:

Okay, this is an interesting find! The comment in config.py was checked
in originally
https://seattle.poly.edu/browser/seattle/trunk/seattlegeni/backend/config.py?annotate=blame&rev=2654
like this.

There is some doc on the backend scripts:

• https://seattle.poly.edu/wiki/SeattleBackend
• https://seattle.poly.edu/wiki/SeattleGeniDesign ("clearinghouse" was
  called "SeattleGeni" before)

—
Reply to this email directly or view it on GitHub
#161 (comment)
.

[aaaaalbert]

The authcode is used to authenticate the different backend scripts to the backend daemon (see its appearances in the CH code).

While the backend daemon should not be reachable from the public Internet anyway, it's still good operational practice to not allow the web server read config files. That said, I think with mod_wsgi the user file/dir access configuration in the Apache config has been simplified a lot, so maybe there is less of an issue these days. The old mod_python and/or previous versions of Django required lots of performance hacks for serving static content etc. which were finicky to set up correctly.