#1  
Old 4th June 2012, 00:56
loadingjkr loadingjkr is offline
Member
 
Join Date: May 2012
Location: Perú
Posts: 85
Thanks: 12
Thanked 0 Times in 0 Posts
Default a security hole in my host!



how to lock folders folders? / var/www/clients/client1/web4/web?
Reply With Quote
Sponsored Links
  #2  
Old 4th June 2012, 08:30
till till is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 35,777
Thanks: 821
Thanked 5,332 Times in 4,184 Posts
Default

1) set php mode to "php-fcgi" in the website settings.
2) Enable the suexec checkbox in the website settings.
3) Add the following line to the custom php.ini settings field of the website:

Code:
disable_functions = show_source, system, shell_exec, passthru, exec, popen, proc_open, symlink, wordwrap, url_fopen, phpcredits, escapeshellarg, escapeshellcmd, proc_close, proc_get_status, proc_nice, proc_terminate, virtual, ini_alter, ini_restore, set_include_path, php_ini_scanned_files, memory_get_usage
Btw. Please use the normal font size and color of the forum for your text and no these big red letters.
__________________
Till Brehm
--
Get ISPConfig support and the ISPConfig 3 manual from ispconfig.org.
Reply With Quote
  #3  
Old 4th June 2012, 23:25
loadingjkr loadingjkr is offline
Member
 
Join Date: May 2012
Location: Perú
Posts: 85
Thanks: 12
Thanked 0 Times in 0 Posts
Default

Quote:
Originally Posted by till View Post
1) set php mode to "php-fcgi" in the website settings.
2) Enable the suexec checkbox in the website settings.
3) Add the following line to the custom php.ini settings field of the website:

Code:
disable_functions = show_source, system, shell_exec, passthru, exec, popen, proc_open, symlink, wordwrap, url_fopen, phpcredits, escapeshellarg, escapeshellcmd, proc_close, proc_get_status, proc_nice, proc_terminate, virtual, ini_alter, ini_restore, set_include_path, php_ini_scanned_files, memory_get_usage
Btw. Please use the normal font size and color of the forum for your text and no these big red letters.

-----------------------------------------------------------------------




-----------------------------------------------------------------------

Reply With Quote
  #4  
Old 5th June 2012, 08:18
till till is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 35,777
Thanks: 821
Thanked 5,332 Times in 4,184 Posts
Default

Please use fastcgi and not cgi as I suggested above.

The screenshot does not mean much, it just tells you that you are able to access files inside your website directory which has to be the case if you wnat to run a php script in your site. Try to access files from another website that does not belong to the same client or add a file in /root as root user and then try to access that file to see if the sites are protected or not.
__________________
Till Brehm
--
Get ISPConfig support and the ISPConfig 3 manual from ispconfig.org.
Reply With Quote
  #5  
Old 5th June 2012, 21:38
loadingjkr loadingjkr is offline
Member
 
Join Date: May 2012
Location: Perú
Posts: 85
Thanks: 12
Thanked 0 Times in 0 Posts
Default C99Shell in ispconfig

Quote:
Originally Posted by till View Post
Please use fastcgi and not cgi as I suggested above.

The screenshot does not mean much, it just tells you that you are able to access files inside your website directory which has to be the case if you wnat to run a php script in your site. Try to access files from another website that does not belong to the same client or add a file in /root as root user and then try to access that file to see if the sites are protected or not.
You can read the files of all clients
I now use fastcgi



how I can fix this hole?

Last edited by loadingjkr; 5th June 2012 at 21:44.
Reply With Quote
  #6  
Old 5th June 2012, 21:52
till till is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 35,777
Thanks: 821
Thanked 5,332 Times in 4,184 Posts
Default

The above screenshot shows some world redable folders and not client files, so this screenshot does not indicate that you can read client files as well. If you want to test that, try to access the web dir of a website of another client and read a file which is owned by the web user of the other site and has 700 or 750 permissions.

Have you set the security level in ispconfig to medium or high under system > server config?
__________________
Till Brehm
--
Get ISPConfig support and the ISPConfig 3 manual from ispconfig.org.
Reply With Quote
  #7  
Old 6th June 2012, 06:38
loadingjkr loadingjkr is offline
Member
 
Join Date: May 2012
Location: Perú
Posts: 85
Thanks: 12
Thanked 0 Times in 0 Posts
Default



high security level
Since client 1 shows client files 2
I can only read the code, but not edited.
Reply With Quote
  #8  
Old 6th June 2012, 08:53
till till is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 35,777
Thanks: 821
Thanked 5,332 Times in 4,184 Posts
 
Default

This website must have been created with security level medium and not the level high as the permissions of the "web" folder are 755 and not 710 or you dont use the current ispconfig version. Please create a new website after you set the securoty level to high and after you updated ispconfig to 3.0.4.5, the permissions of the new "web" directory should be 710 then and you can not access it anymore from another site.

Quote:
I can only read the code, but not edited.
Thats because the default files are world readable as they dont contain any security related code. If you chnage the file permissions to 700 or 750 for a file (you can do this for all new files by changing the default umask of the ftp daemon), then other sites cant read any code inside the files while apache can still execute them.

Beside the Linux permission side layer of security you should check which other exec function is used by the shell that you used to test your server and add this function to the disabled_functions list as well. You can also turn on the php safemode in the custom php.ini field, but safemode is deprecated according to the php developers but it might give you some additional security to turn it on.
__________________
Till Brehm
--
Get ISPConfig support and the ISPConfig 3 manual from ispconfig.org.
Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
My Server Is Sending Spam. How Do I Block This? LordJ Server Operation 1 7th July 2011 19:34
Postfix queue problem? murunix Server Operation 7 2nd May 2011 01:55
Unable to install ISPConfig bdonecker Installation/Configuration 21 26th May 2009 08:20
smtp is error!!! fhawk Installation/Configuration 2 7th April 2009 13:17
Postfix problem: lost connection after CONNECT from unknown fernando_torrez Server Operation 5 30th November 2007 14:17


All times are GMT +2. The time now is 12:56.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.