[Rt-commit] rt branch, 3.9-trunk, updated. rt-3.9.6-241-g228b4bf
Chia-liang Kao
clkao at bestpractical.com
Wed Dec 1 08:07:49 EST 2010
The branch, 3.9-trunk has been updated
via 228b4bf794b4d6fc6684b205d2dc7c1c14c5e331 (commit)
from c803ff05c27ba1d4a69a99465789aeef6669debe (commit)
Summary of changes:
UPGRADING | 147 +-----------------------------------------------------------
1 files changed, 3 insertions(+), 144 deletions(-)
- Log -----------------------------------------------------------------
commit 228b4bf794b4d6fc6684b205d2dc7c1c14c5e331
Author: Chia-liang Kao <clkao at bestpractical.com>
Date: Wed Dec 1 21:07:36 2010 +0800
replace outdated web server configuration instructions with docs/web_deployment.pod
diff --git a/UPGRADING b/UPGRADING
index 58eb94d..686b089 100644
--- a/UPGRADING
+++ b/UPGRADING
@@ -288,151 +288,10 @@ Now, if you want RT to automatically create new users upon ticket
submission, you MUST grant 'Everyone' the right to create tickets.
Granting this right only to "Unprivileged Users" is now insufficient.
+= Web server configuration
-= FastCGI configuration =
-
-This section is a snapshot of the documentation available at:
-
-http://wiki.bestpractical.com/index.cgi?FastCGIConfiguration
-
-It's worth checking out that resource if these instructions don't
-work right for you
-
-
-RT 3.2 includes a significant change to the FastCGI handler. It is
-no longer "setgid" to the RT group. Perl's setid support has been
-deprecated for the last several releases and a number of platforms
-don't bundle the "sperl" or "suidperl" executable by default.
-Additionally, when perl is run SetUID or SetGID, the interpreter
-is automatically switched into /taint mode/, in which all incoming
-data, no matter the source is considered suspect. At first, this
-seems like a great idea. But perl's taint mode is a big sledgehammer
-used to hit small nails. Many perl libraries aren't tested in taint
-mode and will fail when least expected. Moving away from a SetGID
-FastCGI handler will enable more users to have a smoother RT
-experience. It does require some changes in how you set up and
-configure RT.
-
-Beginning with RT 3.2, you have several choices about how to configure
-RT to run as a FastCGI:
-
-
-== Install RT as the user your webserver runs as ==
-
-Pros: Very easy to configure
-
-Cons: Your webserver has access to RT's private database password
-
-
-=== How To
-
-When installing RT, run:
-
- ./configure --with-web-user="webuser" --with-web-group="webgroup" \
- --with-rt-user="webuser" --with-rt-group="webgroup"
-
-(Don't forget to include other configuration options that matter to you)
-
-If you're using apache, you'll want to add something like the following
-to your httpd.conf:
-
- <VirtualHost rt.example.com>
-
- # Pass through requests to display images
- Alias /NoAuth/images/ /opt/rt3/share/html/NoAuth/images/
-
- # Tell FastCGI to put its temporary files somewhere sane.
- FastCgiIpcDir /tmp
-
- FastCgiServer /opt/rt3/bin/mason_handler.fcgi -idle-timeout 120
-
- AddHandler fastcgi-script fcgi
- ScriptAlias / /opt/rt3/bin/mason_handler.fcgi/
-
- </VirtualHost>
-
-
-== Make your webserver user a member of the "rt" group ==
-
-Pros: Easy to configure
-
-Cons: Your webserver has access to RT's private database password
-
-
-=== How To
-
-Install RT normally. Add whichever user your webserver runs as
-(whatever you set --with-web-user to) to the "rt" group (whatever
-you set --with-rt-group to) in /etc/groups.
-
-To find out what user your webserver runs as, look for the line
-
- User some-user-name
-
-in your apache httpd.conf. Common values are www, www-data, web and nobody.
-
-
-
-== Run RT using _suexec_ or a similar mechanism
-
-
-Pros: More secure
-
-Cons: Sometimes very difficult to configure
-
-Apache's _suexec_ utility allows you run CGI programs as specific
-users. Because that's a relatively heavy responsibility, it's very,
-very conservative about what it's willing to do for you. On top of
-that, Apache's mod_fastcgi plugin doesn't respect all of suexec's
-features. While suexec is designed to execute CGI scripts in a
-given virtual host's !DocumentRoot, It can only execute FastCGI
-scripts in the system's *main* !DocumentRoot.
-
-This means you have to copy the RT FastCGI handler into your main
-!DocumentRoot
-
-The following example !VirtualHost will run RT as a FastCGI on
-Apache 1.3 on a Debian Linux server.
-
-
- <VirtualHost rt.example.com>
-
- DocumentRoot /opt/rt3/share/html
-
- # Set the rt user and group as the executing user for this virtual host
- User rt
- Group rt
-
-
- # Pass through requests to display images
- Alias /NoAuth/images/ /opt/rt3/share/html/NoAuth/images/
-
- # Tell FastCGI to put its temporary files somewhere sane.
- FastCgiIpcDir /tmp
-
- # Tell FastCGI that it should use apache's "suexec" binary to call any
- # FastCGI script.
- # This is a GLOBAL setting
- FastCgiWrapper /usr/lib/apache/suexec
-
- # You need to copy the rt mason_handler.fcgi into a directory inside
- # the main server DocumentRoot
- # That directory must be owned by the user and group that will execute
- # the FastCGI script
- # In this case, that directory is /var/www/rt
-
- # To find the local DocumentRoot, run "suexec -V" as root and look for the
- # -D DOC_ROOT parameter.
-
- # Apache 1.3 discards the user and group parameters on the FastCgiServer
- # line. Apache 2.0 requires them.
-
- FastCgiServer /var/www/rt/mason_handler.fcgi -idle-timeout 120 -user rt -group rt
-
- AddHandler fastcgi-script fcgi
- ScriptAlias / /var/www/rt/mason_handler.fcgi/
-
- </VirtualHost>
+The configuration for RT's web interface has changed. Please refer to
+docs/web_deployment.pod for instructions.
UPGRADING FROM 2.x:
-----------------------------------------------------------------------
More information about the Rt-commit
mailing list