vb.org Archive

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   Forum and Server Management (https://vborg.vbsupport.ru/forumdisplay.php?f=232)
-   -   i talked to the hacker.... can someone help (https://vborg.vbsupport.ru/showthread.php?t=193897)

nexialys 10-18-2008 08:36 PM

actually, this whole topic have no place on this site... the ONLY thing you can do is TALK TO YOUR HOST SUPPORT STAFF... isn't it that easy to understand ???

Lizard King 10-19-2008 06:46 AM

Quote:

Originally Posted by Marco van Herwaarden (Post 1647547)
that would still ot prevent anyone with server access (!!!) to read the config file. The only solution in this case is to have your host increase security or switch hosts.

No it will prevent them to read if you correctly chmod and chown the file so nobody expect root access can read the file. Example , lets say we move config.php to /etc/vb the following will prevent anyone expect root access to read the file.
Code:

# chown -R apache:root /etc/vb
# chmod 0640 /etc/vbulletin/config.php

I believe Floren had an article about this within article section , yep here it is :
https://vborg.vbsupport.ru/showthread.php?t=148209

Marco van Herwaarden 10-20-2008 07:14 AM

The webserver process will always need read access to the config file. This will ost likely mean you can not set permissions in such a way that others will not have read access.

Angel-Wings 10-23-2008 09:57 AM

Quote:

Originally Posted by Lizard King (Post 1648155)
No it will prevent them to read if you correctly chmod and chown the file so nobody expect root access can read the file. Example , lets say we move config.php to /etc/vb the following will prevent anyone expect root access to read the file.
Code:

# chown -R apache:root /etc/vb
# chmod 0640 /etc/vbulletin/config.php

I believe Floren had an article about this within article section , yep here it is :
https://vborg.vbsupport.ru/showthread.php?t=148209

Do you read this manual - specially the part about "chown" ?

chown lighttpd config.php

Means nothing else than that the user PHP or the Webserver is running under can read this file. Since this is the case, it's useless to move that file anywhere and then softlink it back in the webroot.
Doing a:

chown root:root config.php

With the 0600 permission would leave the file unreadable to everyone except "root" but this also means you have to run your PHP / Webserver with "root" rights in order that this file can be read by Vbulletin or you'll see the "Database Error" page.

Also - when not creating symlinks that point in your webroot you can configure your Webserver in a way to ignore any symlinked files which might give a performance plus.

The way with moving the file, then symlinking it back has no advantage, a simple "cat config.php" will still work.

Back to the problem - move away from this hoster. If it's possible that another customer can upload a PHP shell - by accident or not - and then someone can browse all sites including the ones of other customers as well there's a huge security problem.

If that is possible - trying to secure your VB installation will never be successful


All times are GMT. The time now is 10:41 PM.

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01013 seconds
  • Memory Usage 1,727KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (2)bbcode_code_printable
  • (2)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (2)pagenav_pagelink
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (4)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 

Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • pagenav_page
  • pagenav_complete
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete