README: provide some more setuid-related explanation

[dyn-nsupdate.git] / README.rst

diff --git a/README.rst b/README.rst
index 9ffaccc46595f1bcdde71d9db13c1ee15185c641..364c3af0d71cd530239dd754a1e233ec19d9e2e4 100644 (file)
--- a/README.rst
+++ b/README.rst
@@ -1,5 +1,5 @@
 dyn-nsupdate: Self-made DynDNS
-===============================================================
+==============================
 
 Introduction
 ------------
@@ -30,25 +30,31 @@ configuration. Furthermore, I assume the directory ``/var/lib/bind/`` exists.
 
 There are two pieces that have to be installed: A setuid wrapper which checks 
 the passwords, and applies the updates; and some CGI scripts offered through a 
-webserver.
+webserver. Please read this guide carefully and make sure you understand the
+security implications of what you are doing. setuid wrappers are not toys!
 
-Let's start with the setuid wrapper. To compile it, you will need cmake and 
+Let's setting up the setuid wrapper. To compile it, you will need cmake and 
 boost, including the regex and program_options boost packages. Starting in the 
 source directory, run::
 
   cd nsupd-wrapper
   mkdir -p build
   cd build
-  cmake .. -DCMAKE_BUILD_TYPE=Release \
-    -DDYNNSUPDATE_CONFIG_FILE=/var/lib/bind/dyn-nsupdate.conf
+  DIR=/var/lib/bind
+  cmake .. -DCMAKE_BUILD_TYPE=Release -DDYNNSUPDATE_CONFIG_FILE=$DIR/dyn-nsupdate.conf
   make
 
-This should compile the binary ``dyn-nsupdate``. If you want to put the files in 
-another directory, change the configuration file name accordingly. You can now 
-install it and the sample configuration file, and set their permissions::
-
-  sudo install dyn-nsupdate /var/lib/bind/dyn-nsupdate -o bind -g bind -m +rx,u+ws
-  sudo install ../../dyn-nsupdate.conf.dist /var/lib/bind/dyn-nsupdate.conf -o bind -g bind -m u+rw
+This should compile the binary ``dyn-nsupdate``. Notice that the path to the 
+configuration file will be hard-coded into the binary. If it were run-time 
+configurable, then a user could call the script with her own configuration file, 
+gaining access to all domains BIND lets you configure. If you want to put the 
+files in another directory, change the configuration file name accordingly. Make 
+sure the file (nor any of the directories it is in) can *not be written by 
+non-root*. The setuid wrapper trusts that file. You can now install it and the 
+sample configuration file, and set their permissions::
+
+  sudo install dyn-nsupdate $DIR/dyn-nsupdate -o bind -g bind -m +rx,u+ws
+  sudo install ../../dyn-nsupdate.conf.dist $DIR/dyn-nsupdate.conf -o bind -g bind -m u+rw
 
 Finally, edit the config file. The format should be pretty self-explanatory. In 
 particular, **change the password**!