a security hole in my host!

Discussion in 'Installation/Configuration' started by loadingjkr, Jun 4, 2012.

  1. loadingjkr

    loadingjkr HowtoForge Supporter

    [​IMG]

    how to lock folders folders? / var/www/clients/client1/web4/web?
     
  2. till

    till Super Moderator

    1) set php mode to "php-fcgi" in the website settings.
    2) Enable the suexec checkbox in the website settings.
    3) Add the following line to the custom php.ini settings field of the website:

    Code:
    disable_functions = show_source, system, shell_exec, passthru, exec, popen, proc_open, symlink, wordwrap, url_fopen, phpcredits, escapeshellarg, escapeshellcmd, proc_close, proc_get_status, proc_nice, proc_terminate, virtual, ini_alter, ini_restore, set_include_path, php_ini_scanned_files, memory_get_usage
    Btw. Please use the normal font size and color of the forum for your text and no these big red letters.
     
  3. loadingjkr

    loadingjkr HowtoForge Supporter

    [​IMG]
    -----------------------------------------------------------------------
    [​IMG]



    -----------------------------------------------------------------------

    [​IMG]
     
  4. till

    till Super Moderator

    Please use fastcgi and not cgi as I suggested above.

    The screenshot does not mean much, it just tells you that you are able to access files inside your website directory which has to be the case if you wnat to run a php script in your site. Try to access files from another website that does not belong to the same client or add a file in /root as root user and then try to access that file to see if the sites are protected or not.
     
  5. loadingjkr

    loadingjkr HowtoForge Supporter

    C99Shell in ispconfig

    You can read the files of all clients
    I now use fastcgi

    [​IMG]

    how I can fix this hole?
     
    Last edited: Jun 5, 2012
  6. till

    till Super Moderator

    The above screenshot shows some world redable folders and not client files, so this screenshot does not indicate that you can read client files as well. If you want to test that, try to access the web dir of a website of another client and read a file which is owned by the web user of the other site and has 700 or 750 permissions.

    Have you set the security level in ispconfig to medium or high under system > server config?
     
  7. loadingjkr

    loadingjkr HowtoForge Supporter

    [​IMG]

    high security level
    Since client 1 shows client files 2
    I can only read the code, but not edited.
     
  8. till

    till Super Moderator

    This website must have been created with security level medium and not the level high as the permissions of the "web" folder are 755 and not 710 or you dont use the current ispconfig version. Please create a new website after you set the securoty level to high and after you updated ispconfig to 3.0.4.5, the permissions of the new "web" directory should be 710 then and you can not access it anymore from another site.

    Thats because the default files are world readable as they dont contain any security related code. If you chnage the file permissions to 700 or 750 for a file (you can do this for all new files by changing the default umask of the ftp daemon), then other sites cant read any code inside the files while apache can still execute them.

    Beside the Linux permission side layer of security you should check which other exec function is used by the shell that you used to test your server and add this function to the disabled_functions list as well. You can also turn on the php safemode in the custom php.ini field, but safemode is deprecated according to the php developers but it might give you some additional security to turn it on.
     

Share This Page