Home Private Messages Search
CPG Dragonfly™ CMS Dedicated Server & Bandwidth Sponsored by DedicatedNOW
Toggle Content
 
Forums ⇒ CMS (All) ⇒ Security :: Archives ⇒ What are security issues if using blank htaccess? :: Archived


What are security issues if using blank htaccess? :: Archived
Post any security related questions in here.
Please send discovered reports to security @ cpgnuke.com
Do Not post links to exploits or hacker sites - your post will be edited/deleted.
If you think you've been hacked, FIRST go through your server logs.

Go to page Previous  1, 2
Post new topic    Revive this topic    Printer Friendly Page     Forum Index ⇒  Security

Topic Archived View previous topic :: View next topic  
Author Message
NEMINI
Diamond Supporter
Diamond Supporter

Offline Offline
Joined: Apr 22, 2004
Posts: 4551

PostPosted: Tue Nov 02, 2004 5:09 am
Post subject: Re: What are security issues if using blank htaccess?

if your host runs php from cgi that line should be moved to php.ini ... most shared hosts run php as cgi for additional security, I knew the answer cause I had that issue way back when it was added back during v1.14 I think

_________________
NEMINI.org, NEMINI.us, NEMINI.info, NYMINI.org

NEMINI's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
1.3.34 (Unix)/4.1.18-standard/4.4.2 /9.1.0.8 CVS
Back to top
View user's profile Visit poster's website Photo Gallery
chris333
Nice poster
Nice poster

Offline Offline
Joined: Jun 06, 2004
Posts: 52
Location: Luxembourg
PostPosted: Tue Nov 02, 2004 5:10 am
Post subject: Re: What are security issues if using blank htaccess?

ok thx, wow you are always so fast and know a lot, thx again Big grin

_________________
www.nukecommunity.com

chris333's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
DebianGNU/1.3.31/4.0.18/4.3.4/8.3 CVS
Back to top
View user's profile Visit poster's website Yahoo Messenger
DJ Maze
Developer
Developer

Offline Offline
Joined: Apr 19, 2004
Posts: 5683
Location: http://tinyurl.com/5z8dmv
PostPosted: Tue Nov 02, 2004 5:12 am
Post subject: Re: What are security issues if using blank htaccess?

Your server is setup to disallow modifications on how PHP works.
Using that line we tried to block the use of registering globals.

example: index.php?get=me

when register_globals is on PHP creates a variable $get with the value 'me'
this could be used as a huge security exploit.

If PHP is default set to register_globals = 0 then you don't have to worry.
Ask your host for the proper setup


DJ Maze's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Fedora 15 / 2.2.22 / 5.5.20 / 5.3.10 / CVS
Back to top
View user's profile Visit poster's website Yahoo Messenger Photo Gallery
NEMINI
Diamond Supporter
Diamond Supporter

Offline Offline
Joined: Apr 22, 2004
Posts: 4551

PostPosted: Tue Nov 02, 2004 5:13 am
Post subject: Re: What are security issues if using blank htaccess?

been using cvs since before 8.2a came out so I've learned as it's changed rather then having to learn everything at once. I screw things up a lot but then I'm not afraid to screw up, I just try to remember and learn as I go, my last resort is seeking help. Which, while it may not be as public, does happen plenty often.

_________________
NEMINI.org, NEMINI.us, NEMINI.info, NYMINI.org

NEMINI's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
1.3.34 (Unix)/4.1.18-standard/4.4.2 /9.1.0.8 CVS
Back to top
View user's profile Visit poster's website Photo Gallery
chris333
Nice poster
Nice poster

Offline Offline
Joined: Jun 06, 2004
Posts: 52
Location: Luxembourg
PostPosted: Tue Nov 02, 2004 5:17 am
Post subject: Re: What are security issues if using blank htaccess?

thx for the informations dj

i had to remove another line to get it work

i changed this:

Options FollowSymLinks -Indexes

to this:

#Options FollowSymLinks -Indexes

what does this bit of code do? is this the mod rewrite function?

_________________
www.nukecommunity.com

chris333's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
DebianGNU/1.3.31/4.0.18/4.3.4/8.3 CVS
Back to top
View user's profile Visit poster's website Yahoo Messenger
DJ Maze
Developer
Developer

Offline Offline
Joined: Apr 19, 2004
Posts: 5683
Location: http://tinyurl.com/5z8dmv
PostPosted: Tue Nov 02, 2004 5:23 am
Post subject: Re: What are security issues if using blank htaccess?

Code::
Options -Indexes
This option prevents directory listing.
When "Indexes" is on and a directory doesn't contain index.htm or index.php (or home.)
The directory will be show as a FTP directory.


DJ Maze's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Fedora 15 / 2.2.22 / 5.5.20 / 5.3.10 / CVS
Back to top
View user's profile Visit poster's website Yahoo Messenger Photo Gallery
chris333
Nice poster
Nice poster

Offline Offline
Joined: Jun 06, 2004
Posts: 52
Location: Luxembourg
PostPosted: Tue Nov 02, 2004 5:35 am
Post subject: Re: What are security issues if using blank htaccess?

ok if i understand it right, this means that this line will show an ftp folder if there is no index / home file in the folder, but it's the nuke root path, most of the time there is such a file in that folder. so wouldn't it be better to add this symbol # as default to block that line. During installation of cpg nuke you could explain the user that if he changes the name of index.php and also in the config file then he should also uncomment that line?

_________________
www.nukecommunity.com

chris333's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
DebianGNU/1.3.31/4.0.18/4.3.4/8.3 CVS
Back to top
View user's profile Visit poster's website Yahoo Messenger
NEMINI
Diamond Supporter
Diamond Supporter

Offline Offline
Joined: Apr 22, 2004
Posts: 4551

PostPosted: Tue Nov 02, 2004 5:36 am
Post subject: Re: What are security issues if using blank htaccess?

it affects all directories not just root.

_________________
NEMINI.org, NEMINI.us, NEMINI.info, NYMINI.org

NEMINI's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
1.3.34 (Unix)/4.1.18-standard/4.4.2 /9.1.0.8 CVS
Back to top
View user's profile Visit poster's website Photo Gallery
chris333
Nice poster
Nice poster

Offline Offline
Joined: Jun 06, 2004
Posts: 52
Location: Luxembourg
PostPosted: Tue Nov 02, 2004 6:14 am
Post subject: Re: What are security issues if using blank htaccess?

ok now it works i forgot to check the whole htaccess file, at the end there was the following code:

# disallow index viewing (like ftp) of directory
Options FollowSymLinks -Indexes
# for hosts that don't allow the above, we won't give people anything to look at
# IndexIgnore *

i changed it as indicated to this:

# disallow index viewing (like ftp) of directory
# Options FollowSymLinks -Indexes
# for hosts that don't allow the above, we won't give people anything to look at
IndexIgnore *

now everything is fine Big grin

_________________
www.nukecommunity.com

chris333's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
DebianGNU/1.3.31/4.0.18/4.3.4/8.3 CVS
Back to top
View user's profile Visit poster's website Yahoo Messenger
coldfire_1989
Nice poster
Nice poster

Offline Offline
Joined: Jul 05, 2004
Posts: 129
Location: Canada
PostPosted: Tue Nov 02, 2004 2:12 pm
Post subject: Re: What are security issues if using blank htaccess?

okie folks, I've a stupid question. Sad How can I remove that Forbidden error from my folders, when I go on any folder it give some the 403 error., i.e mastmp3.com/users/CoLdFiRe_89, I'm using an My_Upload module on my site, and when any user tryes to go in their folder to see wat they have uploaded it gives them an error. is there any way to give Confused permisisons to /users folder and the folders in it.


coldfire_1989's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Linux/1.3.33/4.0.23/4.3.9/9.0.3
Back to top
View user's profile Visit poster's website
DJ Maze
Developer
Developer

Offline Offline
Joined: Apr 19, 2004
Posts: 5683
Location: http://tinyurl.com/5z8dmv
PostPosted: Tue Nov 02, 2004 4:47 pm
Post subject: Re: What are security issues if using blank htaccess?

use "Options FollowSymLinks -Indexes" in the that specific directory the other way round.
Info is available at apache.org


DJ Maze's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Fedora 15 / 2.2.22 / 5.5.20 / 5.3.10 / CVS
Back to top
View user's profile Visit poster's website Yahoo Messenger Photo Gallery
Display posts from previous:   
Post new topic    Revive this topic    Printer Friendly Page    Forum Index ⇒  Security
Page 2 of 2
All times are GMT
Go to page Previous  1, 2

Archive Revive
Username:
This is an archived topic - your reply will not be appended here.
Instead, a new topic will be generated in the active forum.
The new topic will provide a reference link to this archived topic.
 
   Toggle Content User Info

Welcome Anonymous

Nickname
Password
(Register)

   Toggle Content Last CVS commits
· Fixed .ico Expires header.
· Removed domain name from cookies so subdomains wont access them anymore.
· CSS and JS, case insensitives.
· CSS and JS, send correct HTTP 1.1 headers and fixed issues where themes and...
· Further security class improvements.
· 301 redirects on LEO changes
· Option to force 3xx http status codes
· Validate googlebot.com and google.com crawlers.
· CCBot
· Rss with etag and atom.

pročitaj još...

   Toggle Content Community

Support for DragonflyCMS in a other languages:

Deutsch
Español

   Toggle Content X-links
UltraEdit Browse Happy logo Firefox MySQL PostgreSQL Valid CSS! Valid XHTML 1.0! Unicode Encoded Badge NukeBiz Resources Raven DragonflyCMS Dedicated Now InsideSupport Lampe Berger

You are seeing squares or questionmarks on this page?

All content of this website is copyrighted by the Creative Commons NC-SA
The logos and trademarks used on this site are the property of their respective owners
We are not responsible for comments posted by our users, as they are the property of the poster.
Our server runs on a P3 1.2GHz with 512MB RAM with no accelerators
Support GoPHP5.org
Interactive software released under GNU GPL, Code Credits, Privacy Policy