I have put an Access database inside an access_db folder on Godaddy and written some .asp pages that query it. I am trying to make sure that I take necessary precautions against hackers reading or even writing to the database. Maybe someone can give some remarks about whether any of these concerns are realistic, and if so, why and what I could do about it?
1) Could someone somehow navigate directly to the database and read or write to it (the access_db folder seems to have no read/write permissions as set by default by Godaddy, but how secure is that?)
2) I permit entry through use of a a userid and password that are looked up in an mdb in the same folder (not listed in the html itself). If there’s a match, I store the userid as a session cookie. Then, to visit any other pages, each page first checks to see if the cookie is empty before proceeding. Is it possible for someone to set the cookie themselves and thus break through (can a cookie be set manually?) If so, would it help if I mandated that the cookie be set to something specific (right now it just has to be non-blank) or can they find out what the cookie should be set to as well?
I have temporarily turned off SessionCryptoPassphrase for debugging.
The problem is the "Max-Age=900". This makes the cookie persistent in the browser, so that even if the browser is closed, the session will still be valid if a new browser session is started within 15 minutes.
Can I avoid the "Max-Age=900"?
Or should I use mod_headers to rewrite the set-cookie header?
I accidently found that it could be available to de-activate mod_security in a certain directory by using a .htaccess like that...
<IfModule mod_security.c> SecFilterEngine Off SecFilterScanPOST Off </IfModule>
I believe it's something related to the "AllowOverride" directive from apache but im not exactly sure, the available arguments for this directive are "AuthConfig, FileInfo, Indexes, Limit, Options", I've tried hardly to find a way to not to disable the usage of .htaccess files and keep it's functionality but also to prevent it from being able to modify through it the functionality of mod_security.
I'm sure Anyone here could help me in this issue as it's a big pain for any server running apache in a shared vhosting environment.
The hacker just execute the perl file , and then he called the "test.txt" file through internet explorer , and its done , he can read the file easily !
We tried to :
1- run php as CGI module. 2- run SUPHP module. 3- run php as apache module. 4- enable open_basedir and safe_mode.
But the hacker still can bypass the system!
the only solution is to disable /usr/bin/perl , chmoded it to 700 . but thats caused a broken cpanel!
as it requires it to be at 755 for proper operation, since it is used by customers as well when it suexec into the user when they log into cPanel. and so we cannot change it to that setting (700), since it breaks the entire system.
So is there any way to stop the "symlink" perl function?
I just setup an intranet wiki running apache2.2 on ubuntu 12.04. The server currently requires two-way certificate authentication (i.e. a server cert AND client certs).In <VirtualHost *:80>, Redirect permanent / https://<intranetSite>
Everything works dandy, except now that I'd like to find a way to bypass the client cert check for localhost so that I can run some maintenance scripts via cron on the server. Or perhaps it's possible to bypass SSL entirely, just for localhost?
I have a dedicated server. It is a Fedora Core 6. It came with "Plesk 30 domain license". However, this license of Plesk doesn't have SpamAssassin enabled. In order to get the license with SpamAssassin, it costs an extra $30 a month.
I believe SpamAssassin by default is in fact installed on the sever, but some of my users are reporting that they are getting Spam. How can I check is SpamAssassin is running? How do I configure SpamAssassin to filter spam on all the e-mail addresses that are created in Plesk?
how to install CentOS by not using the installer. This guide should be great when installing over networks, don't have a graphical console available (for installing over serial), when you're not content with the installer's job, installing CentOS from another distro, or plainly want to learn more about how CentOS works.
Requirements: * Have a host OS that has the "rpm" package manager available. Some distributions have it in their repositories (even if the package manager for the distro itself is not rpm), and knoppix (a linux live/rescue CD) has it aboard too. You can use the first CentOS ISO CD too (use linux rescue at boot), and it has all the necessairy packages aboard * Access to the CentOS base repository. It's on the first CentOS ISO CD * Use your BRAIN. This guide is ment to be interpreted, not copy/pasted
Code: # First, setup your disks to your liking. You can use whatever you want here, # RAID, LVM, etc... Remember your disk configuration because you'll need it # to configure grub, menu.lst and fstab. Using RAID, LVM, or others will require # more configuration than this guide covers. To keep it simple I'm using a # single disk. An example:
$ fdisk /dev/sda $ mount /dev/sda3 /target $ mkdir /target/boot $ mount /dev/sda1 /target/boot
# Depending on the host OS you're using, you may need to initialize the rpm db # on the host OS $ rpm --initdb
# Use the following command to install the packages. I'll be addressing this # command as $rpm.
$ rpm --root /target -i
# Use your shell's tab completion to complete the package filenames. I # deliberatly left out the versions so these instructions apply to a wide range # of versions
# Let's install some basics $rpm setup basesystem filesystem
# Install bash first, this is needed for post-install scripts $rpm bash glibc glibc-common termcap libgcc tzdata mktemp libtermcap
# Install some dependencies (this is mainly to keep the next command smaller) $rpm grep pcre libstdc++ info ncurses zlib gawk sed ethtool
# If this command gives an error, you can safely ignore this because it's not # of importance. What is important is that grub-install copied the right files # to /boot/grub that we need for booting. $ /sbin/grub-install /dev/sda
# Manually install grub if the previous step failed. - means type it in the grub # shell $ grub $- root (hd0,0) $- setup (hd0)
# Optional packages # You may want to install passwd so you can set passwords ;-) $rpm passwd libuser openldap cyrus-sasl-lib
# These are used to set the keyboard language (loadkeys) $rpm kbd usermode
# ** Right now you should have a bootable system! Here are some tips to help you # through your 1st boot ***
# Most of the system configuration happens in /etc/sysconfig. See
for full documentation.
Some quick post-install tips: * Configure your keyboard in /etc/sysconfig/keyboard using the KEYTABLE variable
* Configure networking Take a look at /etc/sysconfig/network-scripts. See ifcfg-lo for an example.
# This recreates the RPM database. If the host OS you used has a different # version of db, rpm will complain with # rpmdb: unable to lock mutex: Invalid argument $ rpmdb --rebuilddb
I'm trying to create a script to archive logs for 7 days but still delete them from the domlogs daily. Has someone already done this? The ideal solution would be to modify the CPanel script that deletes them after stats run but I'm not sure if thats protected code by CPanel. The other option would be to disable the delete logs after stats run option and to create a script to copy the logs somewhere else via cron and call the script that CPanel uses to delete the logs without restarting apache. This script would also move the files through directories and eventually delete them, therfore preserving the logs for 7 days. Any ideas?
I have created an untested script which should do this but I just need to know how CPanel deletes the logs without restarting apache.