Avoiding The Dreaded 777
Apr 16, 2007
Just wondering what options I have so that I can finally be rid of the 777 folders and lower them to 755?
Problem, I run several scripts that I assumed require 777 permissions, such as forums and gallery scripts. How else would images/attachments be uploaded to the server?
I`m running a linux vps, however I`m relatively new to server security and admin stuff.
Reason I brought this up, quite a few of my 777 folders on various scripts had some unwelcome php and htaccess files added over the last few weeks. No doubt malicious! I only just discovered them this evening.
I keep hearing about PHP Suexec and other features, but I`m concerned using these migh kill the attachment features of a forum for example. What good is a gallery if we cannot upload anything.
I know there are ways around this, but I need something in laymans terms.
View 11 Replies
Oct 22, 2007
security tips to battle against ddos attack?
My server has APF+BFD normal configurations by the manual. Recently I got traffic from router at unusual 16mb traffic
View 3 Replies
View Related
Sep 15, 2008
I volunteer with Spamhaus, the U.K. based anti-spam blocklist. Late last week I was introduced to the Web Hosting Talk forum because a fellow blocklister came under attack by someone who turned out to have quite the record for several types of online lunacy. Since then, I've been reading the board and becoming acquainted with what happens here.
I'm impressed. Most of you appear to be sane :-) and there are some very knowledgeable web hosting professionals here. So I thought I would post about a project I am working on at Spamhaus, and see if I could get some help.
I want to write an article for the Spamhaus web site. It will be aimed at web hosting customers, and will explain how to evaluate ISPs and web hosting providers for security and spam prevention issues. We call this "avoiding bad neighborhoods."
As one forum user (phorum) discovered last week, hosting a perfectly legitimate web site at a rogue provider can mean your web site looses connectivity without warning. Hosting at a bad provider, one that has lax or no abuse enforcement or that deliberately allows spammers to host their web sites on the same IPs as innocent customers, can cause your web site IP to end up on a blocklist despite your having done nothing wrong.
In cases of shared hosting and an indifferent or openly spam-supporting web hosting company, blocklists often find themselves between a rock and hard place: they can list the spammer's IP and hurt innocent customers, or allow the spammer to remain unlisted and hurt innocent users. At some point alleviating the second problem will trump the first.
What we want to do is to provide web hosting customers, especially smaller web hosting customers that may share a server and/or an IP with other web sites, with the tools they need to determine what sort of job their host is doing at keeping a clean network.
Obviously, two of the things to be done are:
* Check reputable blocklists to see how much of a web hosting company's IP space is listed, and (perhaps more important) for how long listings remain active.
* Check reputation services, such at Senderscore.
What other measures would you, as experienced customers of web hosting service, or as web hosting providers, take?
View 14 Replies
View Related
Apr 26, 2008
If I have a customer renting two servers from me, and I collect bandwidth data at the switch port, and he does large transfers between the two boxes that travels through my switch, how do I avoid charging him for that bandwidth? Make him install his own switch? That's the only way I can think to do it. I can limit other people from flooding others on the switch with vlans, but within a vlan, it really isn't fair to bill for traffic that flows between ports, is it?
View 11 Replies
View Related
Oct 28, 2009
I get a lot of messages from CSF about Port Scanning and Bruteforce detection.. Is there a way to avoid all of these attacks ? Because it tries to figure out my clients ftp or pop3 user with several usernames, i.e. administrator, postgres, mysql, httpd, and many more..
I know a little about internet security.. Is it possible to make my public IP of shared hosting untraceable ? Like this one..
Just do a ping to ebay.com or paypal.com and then you will receive RTO message or Destination host unreachable, but actually the site is running well..
View 5 Replies
View Related
