--- a/doc/admin_guide.html
+++ b/doc/admin_guide.html
@@ -392,7 +392,7 @@
 <pre class="literal-block">
 [main]
 port = 8080
-;hostname =
+;host =
 ;user =
 ;group =
 ;log_ip = yes
@@ -411,8 +411,8 @@
 <dl class="docutils">
 <dt><strong>port</strong></dt>
 <dd>Defines the local TCP port to listen for clients on.</dd>
-<dt><strong>hostname</strong></dt>
-<dd>Defines the local hostname to listen for clients on. Only required if
+<dt><strong>host</strong></dt>
+<dd>Defines the hostname or IP number to listen for clients on. Only required if
 &quot;localhost&quot; is not sufficient.</dd>
 <dt><strong>user</strong> and <strong>group</strong></dt>
 <dd>Defines the Unix user and group to run the server as. Only work if the
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -74,7 +74,7 @@
 
     [main]
     port = 8080
-    ;hostname =
+    ;host =
     ;user =
     ;group =
     ;log_ip = yes
@@ -93,9 +93,9 @@
 
 **port**
   Defines the local TCP port to listen for clients on.
-**hostname**
-  Defines the local hostname to listen for clients on. Only required if
-  "localhost" is not sufficient.
+**host**
+  Defines the hostname or IP number to listen for clients on. Only
+  required if "localhost" is not sufficient.
 **user** and **group**
   Defines the Unix user and group to run the server as. Only work if the
   server is started as root.
--- a/roundup/scripts/roundup_server.py
+++ b/roundup/scripts/roundup_server.py
@@ -462,9 +462,9 @@
 
     SETTINGS = (
             ("main", (
-            (configuration.Option, "host", "",
+            (configuration.Option, "host", "localhost",
                 "Host name of the Roundup web server instance.\n"
-                "If empty, listen on all network interfaces."),
+                "If empty, listen on localhost only."),
             (configuration.IntegerNumberOption, "port", DEFAULT_PORT,
                 "Port to listen on."),
             (configuration.NullableFilePathOption, "favicon", "favicon.ico",
@@ -819,6 +819,7 @@
         os._exit(0)
 
     os.chdir("/")
+    os.umask(0077)
 
     # close off std(in|out|err), redirect to devnull so the file
     # descriptors can't be used again