[chef] Re: Re: Rack vulnerabilities in chef-server-webui in Chef Server 11

[Joshua Miller < >]

This seems like a odd idea to me given the only time I used the webui was when I was first playing with chef.  It allows a new user who is unsure to verify his actions in a friendly ui.

Someone who has explored the benefits of chef are more likely to become a paying member.  This is even more true given the recent announcement of commercial support for the open source platform.

Joshua

On Feb 9, 2013, at 9:53 AM, Jesse Campbell < "> > wrote:

Is the intention that starting with chef 12 server, the webui will be a value add of the hosted/private offerings?

On Sat, Feb 9, 2013 at 11:40 AM, Bryan McLellan < " target="_blank"> > wrote:

We believe that the chef-server-webui in Chef Server 11 is vulnerable to recently announced security vulnerabilities in Rack [1]. The Chef 10 webui does not run on rails. We recommend that Chef 11 Server users shut down the webui to prevent any expoitation.

To do so, create '/etc/chef-server/chef-server.rb' and add this line to it:

webui_enable false

Then run 'sudo chef-server-ctl reconfigure'

On Monday we will release a new Chef Server 11 package that upgrades Rack to 1.4.5 to resolve this issue. The webui will be configured to not start by default in Monday's release and subsequent releases and we are deprecating it. The chef-server-webui will not be included in the Chef 12 Server open-source release.

---
Bryan McLellan | opscode | technical program manager, open source
(c) 206.607.7108 | (t) @btmspox | (b) http://blog.loftninjas.org

[1] http://rack.github.com/