Re: Re: hacked!!

On 10/4/2014 7:52 AM, Richard wrote:

------------ Original Message ------------

Date: Saturday, October 04, 2014 13:04:53 +1000 From: Peter West <pbw@pbw.id.au> To: php-general <php-general@lists.php.net> Subject: Re: [PHP] Re: hacked!!

On 4 Oct 2014, at 12:51 pm, Jim Giner <jim.giner@albanyhandball.com> wrote:

On 10/3/2014 8:04 PM, Richard wrote:

------------ Original Message ------------

Date: Friday, October 03, 2014 19:51:59 -0400 From: Jim Giner <jim.giner@albanyhandball.com> To: php-general@lists.php.net Subject: Re: [PHP] Re: hacked!! On 10/3/2014 5:11 PM, ellis@spinics.net wrote:

And how do I know what the web server can do?

The web server *executes* PHP scripts. Most likely one or more of those scripts has a bug that was used to write files into your document tree. Your document tree should not be writable but most likely is. -- http://www.spinics.net/lists/

None of my scripts do any file uploading (to the server). None. I still don't know how I can tell what permissions the web server has.

There is no requirement that your scripts (be programmed to) upload files. All it takes is for you to have a poorly written php script, e.g., perhaps something where you don't properly/fully sanitize values you pick up from the QUERY_STRING, for a hacker to be able to modify a file (assuming that the file permissions are set inappropriately). What are the ownerships and permissions on the directories and files under your web root?

     - Richard

You mean like '644'?

Yes. 644 => (Binary) 110_100_100 => RW-(User)_R--(Group)_R--(Other) Only the User (owner of the files) can write the file, but members of the owner group and all others can read it. Search for "man chmod" and you will get a detailed explanation of permissions. Check directory permissions as well. A file can only be deleted from or added to a directory if the the perpetrator has write permission (as user or group or other) on the parent directory. Peter West

Who (what user) owns the directories and files? What user is the web server (the instance that serves your files) running as? I assume that "you" own the files (and hopefully the directories (from the top all the way down)). But in some shared environments, web server (apache generally) instances are set up for each user -- owned by the user's account. This is done for user separation and security. The problem is that if the user only has one account then the files are always owned by the same user that is running the web server and no amount of file-level control tweaking will make things secure.

      - Richard

My files all seem to have a 644 for permissions. My public_html (root) folder show attribute of

(using Filezilla) owner - r/w/e group - r/w/e public - r/w/e with a numeric value field showing 'xxx' My sub-folders of that seem to be different and I don't know why that is: owner - r/w/e group - r/e public - r/e with a numeric value of 755. The public_html settings are apparently(?) disabled since the screen shows them in a shaded color. So - are all of these correct?