[TYPO3-dev] admin -> BE -> Installtool: Drop the need for a password?

[Peter Russ]

--- Original Nachricht ---
Absender:   Martin Bless
Datum:       23.02.2010 18:54:
> [Martin Bless] wrote:
> 
>> As BE admin I hate the effort of creating ENBABLE_INSTALL_TOOL and
>> entering an often cryptic password.
>>
>> I'm wondering if there is a /conceptual/ reason why BE admins have to
>> enter a password for the Install Tool when there is an open BE
>> session?
>>
>> What do you think about it?
> 
> Thank you very much for sharing your opinion. Here's what I think
> after reading your postings:
> 
> (1)
>  The current situation where BE admin have to create and enter the
> Install Tool password creates the illusion of extra security but its
> only security by obscurity. I don't like it.
Disagreed:
if you disable extension setup with the install tool AND don't allow any 
  ftp-tool within TYPO3 there is no obscurity.
Then only the persons knowing the install password can maintain 
installation and enable extension installation.

> 
> (2)
> I know I can store my passwords safely on my computer. Thats what I
> do. But I hate to look them up over and over again. And I suspect
> other people will as well. And then they are tempted to add the
> KEEP_FILE line and to invent an easy Install Tool PW and so on. IMHO
> thats what really leads to risks.
It's not required to "to look them up again and again" as installation 
of TYPO3 doesn't change that often. E.g. we are using an extension to 
have different accounts setup similar on one shot. Anything we want to 
adjust is in the extension ;-)

> 
> (3)
> I know the Install Tool needs to be a standalone tool. But
> nevertheless there may be an (easy?) way to bypass the the file and
> password checks IF I'm a logged in BE admin. I can't judge on this.
NOT EVERY BE admin should have access to the install. Got it?

> 
> (4)
> To clarify: I was asking for the /conceptual/ reason in contrast to
> any technical reasons or difficulties of implementation as I can very
> well imagine that it might be troublesome to implement. But maybe it
> isn't.
Come up with a better AND practical solution for a large installation. 
As far as I can rememberg your only argument was: "I hate to look them 
up..."
RFC welcome.

> 
> (5)
> I really liked the hint on symlinking the install dir. I like to have
> the typo3_src out of the webroot anyway. This reminded me of making
> sure that the webserver has only read access there. Maybe I'll prefer
> to put an appropriate  .htaccess file there. That way we really have
> an extra level of security as you have to have access to the server.
If ENABLE_INSTALL_TOOL and password is to much work for you I do not 
understand why symlinking should be more comfortable for you ;-)

> 
> And yes, I still think these thoughts are reason enough to think about
> it.
I can't get your intention for this thread:
on the one hand side: everything should be one click easy and on the 
other hand side there might be some security issues you don't know....

jm2c

Peter.


-- 
loans that change lives http://www.kiva.org

_____________________________
uon GbR
http://www.uon.li
http://www.xing.com/profile/Peter_Russ