GOsa
What is it?
GOsa is a web-frontend for administrating user accounts and several other things.
Where is it?
Our GOsa installation can be accessed at [https://gosa.ps.uni-saarland.de]
Hacks to make it secure
GOsa has one potential security hole: it must store the password of an LDAP admin user in its /etc/gosa/gosa.conf, which is by default readable by www-data. We came up with the following solution:
add a dedicated user and group gosa-www
set up a virtual host gosa.ps.uni-saarland.de with suexec user and group gosa-www
install php4-cgi and enable it only for gosa.ps.uni-saarland.de
This means that all php scripts of the dedicated virtual host are executed with php-cgi as user gosa-www instead of using the Apache module with user www-data. Now we can make /etc/gosa/gosa.conf readable by gosa-www only.
Unfortunately, using the standard setup, php-cgi and suexec do not like to play with each other. To make things work, we copied /usr/lib/cgi-bin/php4 to /var/www/cgi-bin/ and set its ownership to gosa-www. In addition, GOsa's spool under /var/spool/gosa must now be writable by gosa-www.
HowTos
How to permit users to change some of their own attributes?
Go to the "ACL" tab of the group gosarights and check all fields the users should be able to adminstrate.
Workarounds
problem: administrator can't edit ACLs of the group ''gosarights''
reason: unknown
solution: go to 'Users' in administration tab, select the corresponding user, go to unix tab and delete both gosarights entries in 'Group membership' field, save, logout, login.