Index: pykota/trunk/SECURITY
===================================================================
--- pykota/trunk/SECURITY (revision 969)
+++ pykota/trunk/SECURITY (revision 969)
@@ -0,0 +1,90 @@
+# $Id$
+
+PyKota - Print Quota for CUPS and LPRng
+
+(c) 2003 Jerome Alet <alet@librelogiciel.com>
+This program is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; if not, write to the Free Software
+Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.
+
+====================================================================
+
+  These recommandations are there because as of April 28th 2003 
+  PyKota doesn't enforce them. You may or may not follow them,
+  depending on your user's IT knowledge, how much your trust them,
+  etc...
+  
+====================================================================
+
+How to improve PyKota's security :
+----------------------------------
+
+  - Ensure that only the user your printing system is run as can
+    execute the pykota filter. Depending on your system's configuration,
+    this may give something like :
+    
+      $ chown lp.daemon /usr/bin/pykota
+      $ chmod 700 /usr/bin/pykota
+      
+    If any user could run the pykota filter, then he theorically could 
+    forbid any other user to print by incorrectly charging them for
+    pages they would never have printed.
+    
+  - Ensure that only the print quota administrator (e.g. root) can 
+    execute the edpykota and warnpykota commands. Depending on your 
+    system's configuration, this may give something like :
+    
+      $ chown root.root /usr/bin/edpykota /usr/bin/warnpykota
+      $ chmod 700 /usr/bin/edpykota /usr/bin/warnpykota
+      
+    or   
+    
+      $ chown root.lpadmin /usr/bin/edpykota /usr/bin/warnpykota
+      $ chmod 750 /usr/bin/edpykota /usr/bin/warnpykota
+      
+    If any user could run warnpykota, then he could fill the mailboxes
+    of all users who are above quota, by repeatedly running warnpykota.
+    
+    If any user could run edpykota, then he could, in the better case,
+    set his account to noquota mode. In the worst case he could render
+    PyKota and/or your printing system completely inoperative.
+    
+  - Ensure that no regular user can read PyKota's configuration file,
+    but that both the print quota administrator and the user the
+    printing system is run as can read it. Depending on your system's
+    configuration, this may give something like :
+    
+      $ chown lp.lpadmin /etc/pykota.conf
+      $ chmod 640 /etc/pykota.conf
+    
+    If the print quota administrator is root then he will always be
+    able to read PyKota's configuration file.
+    
+    Letting any user read PyKota's configuration file may expose
+    passwords or database information which would allow direct
+    connections to it if the user can write and execute his own
+    scripts or download and execute his own version of PyKota.
+  
+  - Secure your database connection :
+  
+    Depending on the database backend used (currently only PostgreSQL
+    is supported), you may have to take additionnal measures to render
+    your database more secure. Please refer to your database system's
+    documentation on configuration to learn how to do so. This is out
+    of the scope of the present document.
+    
+    Keep in mind that if you use a centralized database, you may have
+    to restrict which hosts can access to it (i.e. the Print Servers).
+    
+    
+====================================================================
Index: pykota/trunk/MANIFEST.in
===================================================================
--- pykota/trunk/MANIFEST.in (revision 945)
+++ pykota/trunk/MANIFEST.in (revision 969)
@@ -1,3 +1,3 @@
-include COPYING TODO NEWS CREDITS MANIFEST.in clean.sh bin/pykota bin/edpykota bin/warnpykota bin/repykota bin/README
+include COPYING TODO NEWS CREDITS SECURITY MANIFEST.in clean.sh bin/pykota bin/edpykota bin/warnpykota bin/repykota bin/README
 recursive-include po README *.po *.mo *.pot
 recursive-include man README *.1
Index: pykota/trunk/NEWS
===================================================================
--- pykota/trunk/NEWS (revision 965)
+++ pykota/trunk/NEWS (revision 969)
@@ -24,4 +24,6 @@
     - 1.05alpha1 :
     
+        - SECURITY file added to help improve PyKota's security.
+        
         - Extracting the printer's internal page counter is now
           tried several times, waiting several seconds between
