Bug#863304: greenbone-security-assistant: Greenbone-security-assistant is listening on port 80 and 9392, should only be 9392

[Hans-J. Ullrich]

Package: greenbone-security-assistant
Version: 6.0.11+dfsg.1-2
Severity: important

Dear Maintainer,

in /etc/default/greenbone-security-assistant the parameter 
GSA_REDIRECT=1 is commented out by default. So gsad is also listening on port 80.

But IMHO this should be improved and might be a security problem. 

I suggest, to change the default configuration file, uncomment this parameter and set it to
GSA_REDIRECT=0 

by default. I have set this bugreport to "important", as IMO this is an more important thing and should be fixed as soon as possible. And it can be fixed easily.

Thank you for reading this.  

Best regards


Hans


-- System Information:
Debian Release: 9.0
  APT prefers testing
  APT policy: (500, 'testing'), (500, 'stable')
Architecture: i386
 (i686)

Kernel: Linux 4.9.0-3-686-pae (SMP w/2 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages greenbone-security-assistant depends on:
ii  greenbone-security-assistant-common  6.0.11+dfsg.1-2
ii  init-system-helpers                  1.48
ii  libc6                                2.24-10
ii  libgcrypt20                          1.7.6-1
ii  libglib2.0-0                         2.50.3-2
ii  libgnutls30                          3.5.8-5
ii  libmicrohttpd12                      0.9.51-1
ii  libopenvas8                          8.0.8-2
ii  libxml2                              2.9.4+dfsg1-2.2
ii  libxslt1.1                           1.1.29-2.1
ii  lsb-base                             9.20161125

greenbone-security-assistant recommends no packages.

greenbone-security-assistant suggests no packages.

-- Configuration Files:
/etc/default/greenbone-security-assistant changed:
GSA_ADDRESS=127.0.0.1
GSA_PORT=9392
GSA_REDIRECT=0
MANAGER_ADDRESS=127.0.0.1
MANAGER_PORT=9390


-- no debconf information