X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=doc%2Fsecurity.txt;h=e6eff624f67a30a2e70869f04fa50f2c691c1e41;hp=3711dcfbff4b289c94a29d8b9236b7245e96b1d2;hb=6ab8321f9c45946886a5c34a2df36f418b9aed3a;hpb=962a6686cb2cb8a74ca598ef555dc50a1b8a2742

diff --git a/doc/security.txt b/doc/security.txt
index 3711dcfb..e6eff624 100644
--- a/doc/security.txt
+++ b/doc/security.txt
@@ -23,10 +23,19 @@ further improve the security of your webmail system.
   IMAP server. Note that this makes no sense if both are on the same machine.
   See doc/authentication.txt for info.
 
+- config.php. Some options in conf.pl / config.php allow for passwords to
+  be set in that file, e.g. the addressbook/preferences DSN, and LDAP
+  addressbooks. When setting a sensitive password, check that config.php
+  is not readable for untrusted system users, and consider the possibility
+  of it being read by other users of the same webserver.
+
 - Subscribe to the squirrelmail-announce mailinglist to be informed about new
   releases which may fix security bugs. If you run SquirrelMail packaged by
   your distribution, make sure to apply their security upgrades.
 
+- If you use SELinux, SquirrelMail will not work unless you create a policy
+  for it. In the SELinux Policy Editor, under HTTPD Service, enable
+  "allow HTTPD scripts and modules to connect to the network".
 
 These are only some tips to get you started. A truly secure system needs
 careful tweaking of all components, including PHP, Apache, mailserver,