Security update dicussion

[Eulogy]

Hi dev team!

As we know, suhosin offer only light update since few months. I don't really know if this will be update for the futur developpement.

So I start to think to introduce in the installer, Modsecurity + some usefull fail2ban jails instead of suhosin. 

I don't know what you think about that? 

After that, I saw M.B talk about getting out zsudo in the next update. 

I meet some warning during the Core installation under Ubuntu 16.04 and Fedora.


/etc/sentora/configs/bin/zsudo.c: In function ‘main’:
/etc/sentora/configs/bin/zsudo.c:82:23: warning: implicit declaration of function ‘setuid’ [-Wimplicit-function-declaration]
                 if ( !setuid( geteuid() ) )
                       ^~~~~~
/etc/sentora/configs/bin/zsudo.c:82:31: warning: implicit declaration of function ‘geteuid’ [-Wimplicit-function-declaration]
                 if ( !setuid( geteuid() ) )
                               ^~~~~~~

I don't see any impact in fact. but do you have a patch about that? What is the last update you've got about this change? I can test it if you need.

Eulogy

[Me.B]

We plan to remove zsudo. Zsudo is piping the command it receives and execute them with sudo. We will have instead only few bash files that will execute some required root functions like restarting/reload apache or bind and thus limite down any attack that may target zsudo.

May be later we should split down the front from the backend using an API.

M B