I want to get a VPS to hold my sites and the websites i build for people.
I'm not sure about what happens if a client uploads something they shouldnt - be it porn, warez or whatever.
As a server owner, do i risk getting in trouble? Or am i simply the contact person .
I can't check every file that people might upload.
While reading a lot of posts and blogs about hosting, I just wanted to ask if someone has an idea on how to find files with illegal content.
I just tried a few bash scripts, but if there are a few thousand files, most of them stop working or produce server loads that stop the whole server.
Is there any software already out there or any script to scan the content on server for phrases?
is it legal to host links to indirect content such as rapidshare/megaupload?
I've seen alot of sites hosting these contents and the servers (from traceroute) are hosted in the USA where copyright law are enforced heavily.
what do you think? Will my webhost take my site down if I host these contents?
For future reference whats the best way to show whos using up too much resources such as CPU, RAM etc...
View 2 Replies View RelatedRecently ive gone through lot's of providers, and my latest one computhings.co.uk (was recommended) has recently lost support (their license expired) and my domain is having problems!
I tried a tracert to track the problem and i get an error in resolving the domain name. My DNS servers are set to where they should be, and i can get to the servers via a web browser (ns1/ns2) but when accessing my domain i get a server not found.
Is this my fault or their fault? As if its mine i will hang on and if its theirs im moving servers today!
We've migrated our WHM/CPanel server over to a new set of IP's and for some reason I can't connect to them without using a public proxy, this even includes the providers website now. I can't figure out exactly who is responsible and where the point of failure is exactly...
Traceroute/ping from my home location to the old server (which works)...
---
traceroute to 85.17.13.20 (85.17.13.20), 64 hops max, 40 byte packets
1 192.168.0.1 (192.168.0.1) 1.303 ms 0.872 ms 0.302 ms
2 10.209.128.1 (10.209.128.1) 10.084 ms 8.325 ms 12.404 ms
3 s10-2.cr01-knwk.wa.charter.com (68.186.73.13) 9.361 ms 28.299 ms 10.369 ms
4 68.186.73.49 (68.186.73.49) 19.083 ms 25.163 ms 9.095 ms
5 12.127.79.29 (12.127.79.29) 15.992 ms 30.138 ms 13.872 ms
6 12.127.6.30 (12.127.6.30) 39.046 ms 60.329 ms 23.623 ms
7 12.122.86.45 (12.122.86.45) 14.747 ms 24.446 ms 34.399 ms
8 br1-a350s5.attga.ip.att.net (192.205.33.238) 25.601 ms 21.799 ms 37.404 ms
9 te2-1-10g.ar2.ams1.gblx.net (67.17.92.153) 170.920 ms 170.827 ms 171.122 ms
10 64.213.76.150 (64.213.76.150) 170.045 ms 169.986 ms 175.025 ms
11 62.212.95.146 (62.212.95.146) 178.002 ms 178.664 ms 177.936 ms
12 novosibirsk.v-unix.sbp.attikh.net (85.17.9.244) 182.034 ms 178.866 ms 179.335 ms
13 rakebacknation.com (85.17.13.20) 179.246 ms 181.997 ms 189.018 ms
---
Ping has started ...
PING 85.17.13.20 (85.17.13.20): 56 data bytes
64 bytes from 85.17.13.20: icmp_seq=0 ttl=48 time=178.690 ms
--- 85.17.13.20 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max/stddev = 178.690/178.690/178.690/0.000 ms
---
Traceroute/ping from my home location to the new server (which fails)...
---
traceroute to 77.235.37.113 (77.235.37.113), 64 hops max, 40 byte packets
1 192.168.0.1 (192.168.0.1) 7.087 ms 0.303 ms 0.203 ms
2 10.209.128.1 (10.209.128.1) 18.712 ms 38.402 ms 11.605 ms
3 s10-2.cr01-knwk.wa.charter.com (68.186.73.13) 33.955 ms 41.386 ms 13.996 ms
4 68.186.73.49 (68.186.73.49) 26.398 ms 13.656 ms 20.702 ms
5 12.127.79.29 (12.127.79.29) 12.477 ms 28.289 ms 20.980 ms
6 12.127.6.30 (12.127.6.30) 27.392 ms 19.994 ms 17.067 ms
7 12.127.6.61 (12.127.6.61) 23.416 ms 15.131 ms 14.724 ms
8 192.205.33.114 (192.205.33.114) 21.345 ms 15.118 ms 16.140 ms
9 so-0-0-0.cr2.sea1.us.above.net (64.125.28.186) 16.115 ms 29.307 ms 17.559 ms
10 so-2-0-0.cr2.ord2.us.above.net (64.125.30.222) 72.402 ms 70.323 ms 75.338 ms
11 so-1-1-0.mpr2.lga5.us.above.net (64.125.27.34) 88.384 ms 88.768 ms 88.345 ms
12 so-0-0-0.mpr1.lga5.us.above.net (64.125.27.237) 94.959 ms 86.645 ms 90.357 ms
13 so-7-0-0.mpr3.ams1.nl.above.net (64.125.27.186) 172.967 ms 207.672 ms 201.681 ms
14 ge1-1.sr1.esy.nl.leaseweb.net (82.98.247.34) 169.246 ms 166.772 ms 166.667 ms
15 * * *
16 * * *
17 * * *
//
64 * * *
---
Ping has started ...
PING 77.235.37.113 (77.235.37.113): 56 data bytes
--- 77.235.37.113 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
---
Traceroute/ping from dnsstuff to the old server (which works)...
---
HopT1T2T3BestGraphIPHostnameDistTTLCtryTime
19111.3 ms
66.36.240.2 AS14361
HOPONE-DCA c-vl102-d1.acc.dca2.hopone.net. 255USUnix: 20:35:48. 71
26151.3 ms [+0ms]
66.36.224.232 AS0
IANA-RSVD-0 gec2.core1.dca2.hopone.net. 0 miles [+0]254USUnix: 21:35:29. 17
312211.3 ms [+0ms]
66.36.224.18 AS0
IANA-RSVD-0 ge3-0.core1.iad1.hopone.net. 0 miles [+0]253USUnix: 20:37:31.545
41211.7 ms [+0ms]
206.223.115.86 AS2914
NTTA-2914 ge-4-1-0.mpr1.iad10.us.mfnx.net. 0 miles [+0]251USUnix: 20:35:08.131
51231.9 ms [+0ms]
64.125.30.118 AS6461
MFNX so-4-0-0.mpr1.iad2.us.above.net. 0 miles [+0]250USUnix: 20:35:08.163
64222.4 ms [+0ms]
64.125.27.74 AS6461
MFNX so-6-0-0.mpr1.iad5.us.above.net. 0 miles [+0]249USUnix: 20:35:08.195
72242.5 ms [+0ms]
64.125.29.229 AS6461
MFNX so-4-0-0.mpr1.iad1.us.above.net. 0 miles [+0]248USUnix: 20:35:08.227
83333.0 ms [+0ms]
64.125.28.125 AS6461
MFNX so-1-0-0.mpr1.dca2.us.above.net. 0 miles [+0]247USUnix: 20:35:08.261
9123747474 ms [+71ms]
64.125.27.58 AS6461
MFNX so-0-1-0.mpr1.lhr2.uk.above.net. 0 miles [+0]246USUnix: 20:35:08.429
1092899089 ms [+14ms]
64.125.27.178 AS6461
MFNX so-7-0-0.mpr1.ams5.nl.above.net. 0 miles [+0]249USUnix: 20:35:08.486
11100909090 ms [+0ms]
64.125.31.190 AS6461
MFNX so-4-0-0.cr2.ams2.nl.above.net. 0 miles [+0]249USUnix: 20:35:08.549
12102929090 ms [+0ms]
82.98.242.162 AS6461
MFNX gi3-0.r1.sbp.leaseweb.net. 0 miles [+0]248DEUnix: 20:35:08.602
1391909190 ms [+0ms]
85.17.9.244 AS16265
LEASEWEB novosibirsk.v-unix.sbp.attikh.net. 0 miles [+0]56NLUnix: 20:35:09.147
14124909090 ms [+0ms]
85.17.13.20 ASN=16265[Destination Unreachable] rakebacknation.com. 0 miles [+0]56 Unix: 20:35:09.196
15***99999 ms [+99909ms]
[Unknown][Unknown - Firewall did not respond] -1 miles [+0] 0 miles [+0]
16***99999 ms [+0ms]
[Unknown][Unknown - Firewall did not respond] -1 miles [+0]
---
Pinging 85.17.13.20 [85.17.13.20]:
Ping #1: Got reply from 85.17.13.20 in 90ms [TTL=56]
Ping #2: Got reply from 85.17.13.20 in 91ms [TTL=56]
Ping #3: Got reply from 85.17.13.20 in 89ms [TTL=56]
Ping #4: Got reply from 85.17.13.20 in 90ms [TTL=56]
Variation: 2.0ms (+/- 2%)
Shortest Time: 89ms
Average: 90ms
Longest Time: 91ms
Done pinging 85.17.13.20!
---
Traceroute/ping from dnsstuff to the new server (which works)...
---
HopT1T2T3BestGraphIPHostnameDistTTLCtryTime
11000.8 ms
66.36.240.2 AS14361
HOPONE-DCA c-vl102-d1.acc.dca2.hopone.net. 255USUnix: 20:17:56.686
20020.8 ms [+0ms]
66.36.224.232 AS0
IANA-RSVD-0 gec2.core1.dca2.hopone.net. 0 miles [+0]254USUnix: 21:17:37.642
35211.6 ms [+0ms]
66.36.224.18 AS0
IANA-RSVD-0 ge3-0.core1.iad1.hopone.net. 0 miles [+0]253USUnix: 20:19:40.257
42421.6 ms [+0ms]
206.223.115.86 AS2914
NTTA-2914 ge-4-1-0.mpr1.iad10.us.mfnx.net. 0 miles [+0]251USUnix: 20:17:16.839
56121.6 ms [+0ms]
64.125.30.118 AS6461
MFNX so-4-0-0.mpr1.iad2.us.above.net. 0 miles [+0]250USUnix: 20:17:16.879
62352.1 ms [+0ms]
64.125.29.133 AS6461
MFNX so-4-0-0.mpr2.iad1.us.above.net. 0 miles [+0]249USUnix: 20:17:16.906
733822.1 ms [+0ms]
64.125.27.210 AS6461
MFNX so-1-0-0.mpr2.dca2.us.above.net. 0 miles [+0]248USUnix: 20:17:16.975
876837474 ms [+72ms]
64.125.27.166 AS6461
MFNX so-0-1-0.mpr1.lhr3.uk.above.net. 0 miles [+0]247USUnix: 20:17:17.107
9104888683 ms [+8ms]
64.125.27.221 AS6461
MFNX so-1-0-0.mpr3.ams1.nl.above.net. 0 miles [+0]250USUnix: 20:17:17.208
10108858583 ms [+0ms]
82.98.247.34 AS6461
MFNX ge1-1.sr1.esy.nl.leaseweb.net. 0 miles [+0]251DEUnix: 20:17:17.241
11108838383 ms [+0ms]
77.235.33.50 AS0
IANA-RSVD-0 gianna.v-unix.esy.attikh.net. 0 miles [+0]59GRUnix: 20:19:10.519
1293**93 ms [+9ms]
77.235.37.113 AS0
IANA-RSVD-0
[Reached Destination]77.235.37.113 [No PTR] 59GRUnix: 20:19:10.550
---
Pinging 77.235.37.113 [77.235.37.113]:
Ping #1: Got reply from 77.235.37.113 in 84ms [TTL=59]
Ping #2: Got reply from 77.235.37.113 in 84ms [TTL=59]
Ping #3: Got reply from 77.235.37.113 in 83ms [TTL=59]
Ping #4: Got reply from 77.235.37.113 in 83ms [TTL=59]
Variation: 1.2ms (+/- 1%)
Shortest Time: 83ms
Average: 83ms
Longest Time: 84ms
Done pinging 77.235.37.113!
---
I tried pinging from the new server to 68.186.73.13 since that's showing on the traceroute path, then to 71.83.224.13 (which is the IP my router reports as it's WAN address).
---
root@alpha7 [~]# ping -c 1 68.186.73.13
PING 68.186.73.13 (68.186.73.13) 56(84) bytes of data.
--- 68.186.73.13 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms
---
root@alpha7 [~]# ping -c 1 71.83.224.131
PING 71.83.224.131 (71.83.224.131) 56(84) bytes of data.
From 12.127.79.30 icmp_seq=0 Packet filtered
--- 71.83.224.131 ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms
, pipe 2
---
I tried pinging from the old server to 68.186.73.13 since that's showing on the traceroute path, then to 71.83.224.13 (which is the IP my router reports as it's WAN address).
---
root@old [~]# ping -c 1 68.186.73.13
PING 68.186.73.13 (68.186.73.13) 56(84) bytes of data.
64 bytes from 68.186.73.13: icmp_seq=0 ttl=245 time=170 ms
--- 68.186.73.13 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 170.487/170.487/170.487/0.000 ms, pipe 2
---
root@old [~]# ping -c 1 71.83.224.131
PING 71.83.224.131 (71.83.224.131) 56(84) bytes of data.
64 bytes from 71.83.224.131: icmp_seq=0 ttl=53 time=179 ms
--- 71.83.224.131 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 179.271/179.271/179.271/0.000 ms, pipe 2
---
I am registered with a well known unmanaged VPS provider around here. My IP got listed on Spamhous - actually a whole /24 block is listed, somebody else is doing malware activity and I got the blame as well, since my IP belongs to this block...
Anyway, I've sent a message to the VPS support, saying the story and giving the relevant spamhous listing URLs.
The support's answer was that I should either contact them or wait a couple of days and if this situation is not cleared, contact them (i.e. the VPS) again.
Should *I* contact Spamhous? Is this normal practice in the VPS industry? What about the real IP causing the trouble - if that guy continous his malware activity, what would I gain even if I contact Spamhous?
Is this my issue or VPS provider's issue?
I have noticed over 10 sites hosted on HostFresh which are abusing my copyright and stealing softwares from a company which I'm affiliated with I sent hostresh email to abuse@ however no actions was taken its been almost a month since I sent the email out.
I asked them nicely to remove that infringing site but they do nothing I sent them another email today Waiting to see what happened and I wanted to bring this here for some advice what should I do if they do nothing after another month? I'm not much expierenced with this but the company is loosing a lot of money and I'm being pressured, hiring a lawyer is a lot of money too so I tried to get it fixed with emails but they dont want to help me solve this.
I know theres a hostfresh rep here
I have a cpanel 11 server with php 4.4.6 installed. my site use php scripts and one day even if the file was not edited, not touched at all , i get errors like
Parse error: syntax error, unexpected ']' in /home/xxx/public_html/wp-includes/post.php on line 37
I checked and could find a lot of illeagal characters in my php file. See below. for post_status , it became post_statuó and edit_date became edit_date<8d>. If you read through the code, you can see a lot of illegal characters. This is why i get parse errors. I had to replace the file from backup and the issue fixed. But this problem continues to occur for more files and i can't find a reason for this. Again I am the only one with access, I use BBedit to edit php files when needed in Mac OS X, and beleive I know what is being edited and again, those file which gets errors does not need to be edited for nothing, not even to modify wordpress.
======================================================
iN ( 'draft' == $post['post_statuó'] && empty($postarr['edit_date<8d>]) && empty($postarr['post_date¯]) &&
('0000-00-00 00:00:00' == $post['post_date']) )
$clçar_date = true;
else
$clear_nate = false;
// Merge old and"new fields with new fields overÃriting old ones.
$postarr = arRay_merge($post, $postarr);
$poytarr['post_category'] = $post_cáts;
if ( $clear_date ) {
$poótarr['post_date'] = '';
$postërr['post_date_gmt'] = '';
}
éf ($postarr['post_type'] == 'at|achment')
return wp_insert_atÃachment($postarr);
======================================================
I am not a web host. I do have my own server that I host my company sites on and some of my friends use it as well.
I had someone ask me if I could host about ten pages on my server for him. He said the following," Hello. What is your base hosting price... say for a dozen page static site? (making some Page Rank sites on different hosts to mask the connections to my main website)"
This question gave me an uneasy feeling, but then again I am not familiar with this tactic. I have two questions since the above was asked.
1. Is this illegal by search engine rules.
2. Can my websites be affected if it is.
I saw a website a few days ago hosting Warez and hacking, But they wasn't directly download from there website. They was only linking? is this illegal in the UK just to link to warez, Like to rapidshare, megaupload, etc..? Whats there law like?, Can anyone explain if this is a good idea or not?
View 10 Replies View Relatedi have moved my hosting to a new provider and i was wondering what is the quickest way to upload my 500MB files to the new server? Is there anyway i can speed this up like have a dedicated uplink port to my server, or via VPN or something, cos at the moment i have an upload speed of around 10KB/s,
View 5 Replies View RelatedMy requirements are 500MB, 5GB bandwidth, rails and postgres, $5-6 per month. It looks like there are many providers out there that are offer that.
However the only uploading method shared hosters seem to offer - or at least the only method they advertise - is FTP. Coming from a university and sysadmin background, I thought that anything that sends passwords over the wire unencrypted had died long ago (except HTML forms and legacy systems).
Are there any shared hosting services that allow a more secure upload method (e.g. scp, rsync-over-ssh, even webdav-over-ssl)?
company for over a month or 2
contacting them (support tickets) is as useless as not!..
their reply is always simply: we checked and nothing at our side! (asking for a clarification simply gets u nothing!)
problem is simply ONLY with ftp uploads!
my line upstream is 256Kbps (32 KB/sec) and down 1Mbps and i was always capable of pushing up to 2.2 GB/day ((i monitor my traffic all the time))
but just recently some weird things started appearing...
before uploads would never go under 27-26 KBs on my FTP client
now it's so normal finding it dropping to 15,10,4,2, 0!
ya a whole 0!
and that's not just for a second or two
it can stay like that for maybe aminute then go up back again!
And upon watching my traffic statistics closely, i found myself pushing at the most 1.6 GB only a day!
another funny thing is that files used to appear AND PARTIALLY in the root directory instead of the desired directory!
so WHAT IS UP!
On my dedic the uploads arent working... I am talking about normal http upload.
In my php.ini uploads are set as On and max file is 100mb.. my tmp is 777
possible error be?
How would I go about reporting a website for illegal hacking and other activities?
Their host is fully supporting them. They have even given them the ip address of the proxy I used, in which case the client of theirs have added the proxy to their htaccess deny list.
Ok i get 403 forbidden when i try to access /uploads/ on my server. I wish to make it public. Can i make a index.html file dispay all of the files in the directory?
View 5 Replies View RelatedI am about to purchase a reseller (Diamond) or maybe just a Hosting (Swamp) but I cant seem to find anywhere details on their MySQL policies.
I have a forum and the database if growing in size daily and im concerned about the database upload limit that may be applied. I have a dedicated server at the moment and im able to request that be changed via php.ini but where would I stand on this if I were to move to shared hosting?
We are going to host our own website. I built up a windows 2003 server. Installed IIS6. I am working on file upload to our website. I can get files to upload to c:Temp but not to c:Inetpubwwwrootourwebsiteupload.
I even set up the upload directory for full sharing with write permissions. Still no help.
I went into windows explorer and right clicked on the upload dir and shared it and set the permissions for read and write. That should take care of NTFS permissions. But no matter what I do when I click on the upload directory and go to properties is shows 'read only'. Can't seem to get that turned off. Until I do I don't believe I can upload a file to the upload directory.
I went into iis6 mgr and and set the upload directory for full access - read and write. That should take care of iis security.
I went to default website (there is only one) and allowed anon login. Even told it use the Administrator account for login with all read and write permissions.
Here is my upload code: ....
Last week my brother puchased a CD which promised contains thousands of unique templates through [url]
He sell it locally for Indonesia market and leave no contact info.
He showed me and I'm surprised that what did guy did is copied from all sources included templatesmonster.com majority which is available alot of through the net (example: [url]burn it into CD and sell it illegaly.
I reported the site to hostgator.com and got the followin reply:
---------------------------------------------
Hello,
Since there are no templates on the site, you will need to provide evidence of this some how.
Regards,
Richard F.
Network Security Administrator
ISP Blacklist Administrator/Level 3 Systems Administrator
PGP Key: [url]
---------------------------------------------
I'm not trying to bash HG, but I need your opinion: is the HG respond is already correct?
So learn from the same thing, if I set a website sell cracked properties and only delivery the product through CD or email (not downloadble one) I can host it with HG as long as no offensive files in their server? Or in this case HG just ignore it because could not understand Indonesia languange?
i'v sent to sharktech.net - rackvibe.com / an emails since a week about an illegal hosting on thier ircd services, but can i know why the identity theft irc servers is still running?
i have sent to both abuse emails to:
abuse@rackvibe.com
abuse@sharktech.net,
from a differnt email addresses with a hope to see a responce, but they never did.
i wounder how the both companies feel when people credit cards and thier bank accounts are being sold and traded under thier service.
i'v sent to sharktech.net - rackvibe.com / an emails since a week about an illegal hosting on thier ircd services, but can i know why the identity theft irc servers is still running?
i have sent to both abuse emails to:
abuse@rackvibe.com
abuse@sharktech.net,
from a differnt email addresses with a hope to see a responce, but they never did.
i wounder how the both companies feel when people credit cards and thier bank accounts are being sold and traded under thier service.
I just moved to a new, dedicated server this week. My vbulletin forum users typically upload mp3 files under 10MB. At the moment, I can't seem to get anything above 6MB to work.
In vBulletin land, they recommend changing these in php.ini:
upload_max_filesize - Largest size of a file to accept.
post_max_size - Must be larger than upload_max_filesize.
memory_limit - Should be larger than post_max_size.
max_execution_time
max_input_time
I've cranked all of those up and restarted Apache.
I'm still having the same problems. The little window with the form turns white after what appears maybe 5 minutes, but I haven't timed it.
They also mentioned changing the LimitRequestBody in Apache. I appear to be screwing that part up so I created a thread in the Apache forum specificallya about that.
[url]
So I wanted to ask if there were any other possibilities that you guys could think of that would inhibit the file size up uploads via a form.
I'm running httpd-2.2.8 and php-5.2.6. It needs to be said that this forum is config is mostly right out of the box. $_SESSION wouldn't work in php until I changed the directory for it yesterday. So there may be a very basic config setting that I missed.
---------
I decided to check my error logs.
PHP Fatal error: Allowed memory size of 33554432 bytes exhausted (tried to allocate 9852343 bytes)
I'm confused. I have an allowed memory of 30MB (give or take). So why does a 10MB file "exhaust" it?
We have a server that we just changed over to PHPSUEXEC. On this server, we have a large IPB (Invision Power Board) forum that we have not been able to get uploads in the forum back working again. Users are getting the message that they don't have permission, and to contact an administrator.
I have looked on IPB's forum for PHPSUEXEC related issues, but can't find a solution. Of couse, before phpsuexec the "upload" folder had 777 file permissions, but under phpsuexec this must be 755. It isn't working though.
Anyone had experience with this with IPB and know how to fix it?
i have a problem with my server it wan't boot, i get the following error on /tmp
fsck.ext3 e2fsck_read_bitmaps illegal bitmap block
how can i fix?
I've been running pure-ftpd for around 4 months now without any problems, until around 24-48 hours ago file upload has been going a bit loopy.
When you upload a file the speed bounces considerably, and at times pauses on 0kbps until it then dies and fails the upload. 9/10 uploads I have tried have failed.
[R] Opening data connection IP: 74.86.20.181 PORT: 35283
[R] LIST -al
[R] 150 Accepted data connection
[R] 226-Options: -a -l
[R] 226 6 matches total
[R] List Complete: 374 bytes in 0.64 seconds (0.6 KB/s)
Transfer queue completed
1 File failed to transfer
[R] Connection lost: chacha
We have restarted pure-ftpd a number of times, but have had no luck.
Please could you try and upload a file (at least 10mb and please nothing dodgey) to this FTP account:
address: chacha.99k.org
user: chacha@99k.org
pass: password
And output the result.
Does anyone here have experience with pure-ftpd and would possibly consider giving my system a "once over"?
I'm currently a video sharing site and I'm aiming for large videos (around 500MB - 1GB), now I have to take into account an average user should only be able to do 30k-50k per sec.
So the session_timeout and upload_max need to be adjusted. Anybody with experience with large upload sites ?
First of all, I discoverd this forum during my quest to unravel the mysteries of how my site was hacked. I hope this is an appropriate forum to discuss the issues even though I am not a web hosting provider, but merely a customer of a web hosting company, hostrocket.com
I have an installation of WordPress 2.1 WordPress creates a couple world writable directories such as Uploads and Cache which are owned by nobody. Apparently (according to the tech support at hostrocket.com) someone was able to insert and exectue a php script in my world writable Uploads directory. Over 40MB of scripts, executables and files were uploaded. As best I can tell, my space was being used as some sort of link farm or perhaps acting as a server in my webspace. I do not have much knowledge about these things and consequently can't talk very inetlligently about them. But I am trying to grasp what little I am able to absorb about how this could have happened, what I can do to mitigate it from reocurring in the future.
Some of the stuff that was in the directory is as follows...
2421
bindz
h4ckerz
mass.pl p
trace-kmod
2421.1
brk
help.php
mybindshell
ptrace24
99.php
coredump
idf.php
netcat
pwned
CMD.php
dc.pl
index.html
online
r0nin
TMT.htm
elfdump
kmod2
online.tar.gz
raptor
TTdummyfile
gcc
krad3
prctl2
uselib24
bind.pl g
cc.1
list.txt
ptrace
The "online" directory contained over 40MB of directories such as...
abortion diethylpropion
accounting diflucan
accupril diovan
acne distance-education
actonel dospan
actos dovonex
acyclovir doxycycline
adderall drug
adipex drug-rehab
adventure-travel drug-test
adware dvd
adware-spyware e-pathto
affiliate-program effexor
air-travel elavil
aldara enalapril
alprazolam equity-loan
altace estradiol
amaryl evista
ambien fioricet
amitriptyline flexeril
amoxicillin flonase
amoxil florida-lottery
antivirus fluoxetine
atenolol fosamax
ativan free-poker
avandia free-slots
avapro free-spyware
baclofen furniture
bankruptcy gambling
bextra home-equity-loan
biaxin home-loan
bingo hosting
black-jack hotel
blackjack hydrocodone
blackjack-game images
bontril imitrex
britney-spears insurance-life
business internet-betting
buspar internet-gambling
buspirone loan
butalbital loans
buy-hardware lortab
buy-phentermine lottery
california-lottery lotto
captopril mesothelioma
car mortgages
car-insurance online-black-jack
carisoprodol online-casino
cars online-gambling
cartia online-loan
cash-loan online-pharmacy
casino online-poker
casino-games online-roulette
casino-las-vegas online-slot
celebrex payday-advances
celebrex-online phentermine
celexa poker
celexa-online poker-chips
cephalexin poker-game
cialis poker-tables
cigarette refinance
cigarettes refinance-house
cipro refinance-loan
claritin refinancing
clindamycin ringtones
clonazepam roulette
clonidine slot-machine
codeine slot-machines
consolidate-card slots
cozaar steroids
credit structured-settlement
credit-card texas-holdem
credit-card-debt texas-holdem-poker
credit-card-debt-consolidation texas-holdem-rules
creditcard texas-lottery
cyclobenzaprine tramadol
darvocet travel
dating travel-insurance
debt-consolidation ultram
debtcard valium
denavir viagra
diazepam vicodin
diclofenac video-poker
didrex wagering
diet-pills xanax
As you can see, I was had in a BIG way.
So the first thing my webhost had me do was to change ownership of the directories owned by nobody to me. Then I was able to change permissions from 777 to 755. However in so doing, I am no longer able to use the Dashboard of WordPress to upload images anymore, unless I temporarily change permissions back to 777.
The other thing the tech support guy did is to create an .htaccess file with,
php_flag engine off
I guess this basically renders php scripts impotent from running.
So without flaming me, can you help me understand how someone in a shared server environment is able to put a php script into one of my directories?
What amazed me was this particular script, "99.php" actually when viewed in a browser window titled phpshell was called "c99adult v. 1.0 pre-release build #16". It basically enabled whoever had access to the URL, to view my webspace, and do all sorts of nasty things. Talk about a wake-up call!
Obviously this enabled the hacker to view my config.php file and ascertain my database password and everything else. Whether he did, or whether there is a logfile of that info that could enable him to hack the database at some time in the future is unknown to me but it's really freaking me out.