Security help.
 

Hello,

I've recently moved my forum to a dedicated server, it has windows server and now all the folders like includes, images, all can be viewed by anybody, i mean, if you go to myforum.com/includes I can see all the files that the folder has .. and there IS a index.html file but it still shows the folder content..

I have:

windows server 2003
for the webserver im using XAMPP

any idea of how to fix this?

Remove the link to your forum from your sig.

Turn off your forums, remove your config.php file and change your username/password for your database. Update your config.php file to reflect them, but don't upload it until this issue is resolved.

Now go talk to your host about this issue. That should NOT be happening.

Okay, I did what you said..

now, I am my hosting xD .. I have a dedicated server with Softlayer .. And for the webserver I use a software called XAMPP, and I use windows server 2003 SP1 .. any ideas why the folder contens are displaying indead of a blank page?

if you need any more details let me know.

thanks!

Open IIS, then properties for the virtual directory in the General tab un-check the Directroy Browsing option.

Sorry, but I don't know windows servers at all, so I have no clue what the problem could be. You may want to search the Server Configuration forum over on vb.com

edit: Anthony to the rescue. :)

I am not very experienced on this. Could you tell me where I find the IIS?

Thanks.

On the start menu, click administrative tools, and then click IIS manager.

Hm.. seems like my dedi doesn't has that option, take a look:

http://geupload.com/images/administra.jpg

thanks

edit:

I made a support ticket on softlayer asking about IIS and they told me that they will check if I have it installed in my dedicated server.

thanks again for your support.

--------------- Added 25 Sep 2009 at 18:18 ---------------

Softlayer installed The IIS Manager to my dedi, but now, I can't find the options to disable the directory browsing option.

image:
http://geupload.com/images/iismanager.jpg

Whats listed under the "+ default website" area?

Hmm - Xampp isn't using IIS ;)

It's a typical Apache + MySQL combo so playing with IIS won't help at all. When using a Windows Server anyways you may change your setup to just use MySQL and as Webserver IIS + PHP as Isapi module.
Then setup IIS with directory permissions - like IP protection for "config.php" that only 127.0.0.1 can access it.

But - maybe thought about a managed server ? Just remember the worst case someone will abuse your server for sharing warez or even more bad things ?