Sentora security questions

[krisinho]

Hi I am considering using sentora in production but i have 2 questions:

1. why sentora is using 777 everywhere!? for me as a sysadmin this is totally crazy (or there is something i dont know about?). I totally dont understand this how can you release a software that uses 777 everywhere!

drwxrwxrwx. 13 root root 4096 04-28 21:03 configs
drwxrwxrwx. 2 root root 6 04-28 21:03 docs
drwxrwxrwx. 8 root root 4096 09-07 20:31 panel

2. why sentora is using just "md5" hash for password without any salt? i.e for mailbox module?

$password = '{PLAIN-MD5}' . md5($password);

md5 hash is very weak.