[Bug 255106] www/caddy: rc.d/caddy requires admin API for stopping
bugzilla-noreply at freebsd.org
bugzilla-noreply at freebsd.org
Fri Apr 16 04:36:05 UTC 2021
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=255106
Bug ID: 255106
Summary: www/caddy: rc.d/caddy requires admin API for stopping
Product: Ports & Packages
Version: Latest
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: Individual Port(s)
Assignee: adamw at FreeBSD.org
Reporter: thijs at vandien.net
Assignee: adamw at FreeBSD.org
Flags: maintainer-feedback?(adamw at FreeBSD.org)
Caddy can be controlled using an admin API endpoint that it serves on
localhost:2019. Having that enabled is not ideal from a security perspective,
because any user able to log in may connect to it.
Disabling it with `admin off` in the global config breaks `service caddy
reload` as well as `service caddy stop`. The former (as of Caddy 2) does not
appear to have an alternative anymore, but perhaps at least the latter could be
rewritten using to make use of `kill`? Meanwhile, I'll then file an issue with
the Caddy project so we can hopefully fix reloading after.
--
You are receiving this mail because:
You are the assignee for the bug.
More information about the freebsd-ports-bugs
mailing list