Security and Cryptography
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me

The Shed is going Social! Join us on FaceBook and Twitter and chime in on the conversation.

Go Back   Dev Shed ForumsSystem AdministrationSecurity and Cryptography

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old September 2nd, 2002, 04:11 PM
AbuAnas AbuAnas is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Mar 2001
Posts: 19 AbuAnas User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 12 m 44 sec
Reputation Power: 0
Unhappy preventing hacking from inside

Hi,

I have looked for this on the net over the nights but couldn't find an answer, though it sound so obvious.


In a linux box that is working as a web server hosting many sites. I descovered that a user can leave out his home directory and the read others files and obtain very important data like database passwords and then use it to destory thier data. The problem is that those files must be chmoded to 755 in order for them to function.

Is there any way or some modified shell that would prevent users logged in via ssh/telnet to read files that are located outside of thier main home directories ?!



thank u ..

Reply With Quote
  #2  
Old September 2nd, 2002, 04:25 PM
bricker42 bricker42 is offline
Moderator =(8^(|)
Dev Shed Intermediate (1500 - 1999 posts)
 
Join Date: Feb 2002
Location: Sacramento, CA
Posts: 1,710 bricker42 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 20 m 38 sec
Reputation Power: 13
Send a message via AIM to bricker42
One way, matbe not the best, is to put all the users into one group, maybe accounts, then make all files 705. There's probably a more secure way of doing this, though.

Reply With Quote
  #3  
Old September 20th, 2002, 06:32 AM
alexgreg's Avatar
alexgreg alexgreg is offline
Full Access
Dev Shed Regular (2000 - 2499 posts)
 
Join Date: Jun 2000
Location: London, UK
Posts: 2,019 alexgreg User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 3 sec
Reputation Power: 15
Run suEXEC so that the web server executes CGI's with the permission of the owner. This way the files can be 700 and they will still function in a web serving context.
__________________
Alex
(http://www.alex-greg.com)

Reply With Quote
  #4  
Old September 20th, 2002, 08:25 AM
AbuAnas AbuAnas is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Mar 2001
Posts: 19 AbuAnas User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 12 m 44 sec
Reputation Power: 0
Thank you guys for your contrbuitions


bricker

I am not sure this would be working if you are having some kind of hosting panels like WHM?CPanel or ensim coz they do alot pf work behind the scene.


Alex

This would solve the cgi problem but what about php which is more common those days?



AbuAnas

Reply With Quote
  #5  
Old September 20th, 2002, 09:20 AM
RichA. RichA. is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Jan 2002
Posts: 170 RichA. User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: < 1 sec
Reputation Power: 12
To stop ssh/telnet users from accessing others files, they need to be chroot'ed to their home directory.
Another way is to set the permissions on each home directory to 750, and change the group to the webservers group.

To stop PHP from one users directory from accessing anothers when run byu the server, you should be able to use the PHP config files - possibly in conjunctions with some SetEnvIf and Allow/Deny statements in the Apache Config.
__________________
Candyman. CandyMan. Candy ... Oh, Hi !

Reply With Quote
Reply

Viewing: Dev Shed ForumsSystem AdministrationSecurity and Cryptography > preventing hacking from inside

Developer Shed Advertisers and Affiliates



Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump

Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 


Powered by: vBulletin Version 3.0.5
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.

© 2003-2013 by Developer Shed. All rights reserved. DS Cluster - Follow our Sitemap