[web2py] Re: security check in web2py

2012-02-10 Thread nick name
I usually run it with -i 0.0.0.0 , which means it listens simultaneously on 127.x.y.z and on any other address the computer might have. The admin pages are accessible only when coming through localhost (127.0.0.1) or ssl, no need for different processes/ports.

[web2py] Re: security check in web2py

2012-02-10 Thread Ross Peoples
Another option, which I use is to generate SSL certs and run web2py with -k and -c so that web2py runs on SSL, enabling admin from other computers.

[web2py] Re: security check in web2py

2012-02-10 Thread Massimo Di Pierro
Ciao Massimo, You suggest you do not disable it. Instead run: python web2py.py -i 10.0.1.7 -p 8080 -a '' python web2py.py -i 127.0.0.1 -p 8081 -a xx then connect to 8081 via ssl tunnel. exposing admin without https is a major security risk. If you really want to do, you can comment the chec