Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[jbc]

Hi !

I run Amule on a Asus RT-N16 router, perfectly smoothly, thanks to your help (I had a lowID due to the fact that the router required manual firewall exceptions to have highID -  solved on this forum)

Here is my question : when launching Amule from command line, it specifies that it's better not to launch it as root, for safety reasons. But in my case, Amule is launched by an init string on router startup, and it seems that it launches it as root.
So :

- Why is it better not to launch it as root ?
- Is there a mean not to do so, in this precise case ?

Thanks a lot.
JB

[btkaos]

Here is my question : when launching Amule from command line, it specifies that it's better not to launch it as root, for safety reasons. But in my case, Amule is launched by an init string on router startup, and it seems that it launches it as root.
So :

- Why is it better not to launch it as root ?

In desktop Linux system root isn't meant to be used. The files created by amule would be owned by root and you could have some troubles, problems integrating with firefox, etc... Of course any security bug in amule will also get root privileges.

In your case (embedded router) IMHO you can run amule as root without worrying too much.

- Is there a mean not to do so, in this precise case ?

You could create an amule user and use the sudo or su command.

[jbc]

Hi,

thanks for reply. The problem is that I have all my personnal data stored on the same disk which I use for storing amule data. This disk is mounted on the router. Do you confirm it can cause security problem in this configuration ?

Also, can you please be more precise when you say to create a user and use sudo command, please ?

Thanks
JB

[btkaos]

The problem is that I have all my personnal data stored on the same disk which I use for storing amule data. This disk is mounted on the router. Do you confirm it can cause security problem in this configuration ?

IMHO it should be safe as long as aMule has no security bugs. Keep in mind the mapping of users when mounting the disk, the users should match.

Also, can you please be more precise when you say to create a user and use sudo command, please ?

You can use the sudo command in order to run commands as other users. Let's say I'd like to run amule under the user btkaos, then I'll use "su btkaos amule" or something like that. But I think that's not needed in your configuration if you map the router user "root" to the actual user of the files.

[lfroen]

IMHO it should be safe as long as aMule has no security bugs.

Can't stop laughing here. aMule crashes are reported every other day. So yea, it should be safe, definitely. That said, keep in mind that aMule-on-router is quite rare configuration. Rare as dragon, I would say. So, I guess chances for "accidental hacking" are slim to none.
Have fun.

[Kry]

Methinks someone missed the "security" word, but I'm probably now going to told how all crashes are security crashes etc.

[btkaos]

Methinks someone missed the "security" word, but I'm probably now going to told how all crashes are security crashes etc.

Indeed I'm very interested in hearing about emule/amule security bugs, I think the only other vulnerable aMule part is the network code, and it has been there for long. Kad could have some, last known in emule is security fix of v0.47c.

Anyways it is a PITA that emule devs don't use version control, that way interesting changes to Kad and some similar parts could be easily integrated in aMule.

[Stu Redman]

They do afaik, but it's not public.

[btkaos]

They do afaik, but it's not public.

Good to know then, I'm sure amule is already profiting from that.

Regarding aMule's bugs, just GTK is so buggy than we will suffer some bugs, that's sure.

[GonoszTopi]

emule devs don't use version control,

They do afaik, but it's not public.

Right.

Good to know then, I'm sure amule is already profiting from that.

Not really. Kry's the only one who might have access to their repo, but I'm not sure he does. Many eMule features were ported by diffing the released source to the previous version and hunting the related changes.