User Can See /etc/passwd. How To Stop This
Sep 1, 2007
We have CentOS and WHM 11 on the server. Also we have PHP 4.4.4 and open base dir enabled on the server . We have a shared server with many website configured on it.
Now The user uses the following PHP code and can see the /etc/passwd file
=============================================
<?
echo ini_get("safe_mode");
echo ini_get("open_basedir");
include("/etc/passwd");
ini_restore("safe_mode");
ini_restore("open_basedir");
echo ini_get("safe_mode");
echo ini_get("open_basedir");
include("/etc/passwd");
?>
============================================
Now how to stop this. This is a security hole. how to stop this.
View 11 Replies
ADVERTISEMENT
Feb 14, 2008
i run one bad command :-(
chmod -R 644 /
and this command changes all permision in root server
have any away for fixed all permision in centos?
because all site take error
i use of cpanel
View 14 Replies
View Related
Jul 20, 2008
Permission denied: /home/airtrade/etc/airtrade.com.tw/passwd passwd this is the error message obtained upon trying to create email accounts in cpanel.
the present permissions of the passwd file is 644 and ownership is username nobody i tried changing it to username.mail but still the same error
View 1 Replies
View Related
Mar 4, 2007
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0ync:/sbin:/bin/sync
shutdown:x:6:0hutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0perator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81ystem message bus:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
netdump:x:34:34:Network Crash Dump user:/var/crash:/bin/bash
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
sshd:x:74:74rivilege-separated SSH:/var/empty/sshd:/sbin/nologin
rpc:x:32:32ortmapper RPC user:/:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin
htt:x:100:101:IIIMF Htt:/usr/lib/im:/sbin/nologin
canna:x:39:39:Canna Service User:/var/lib/canna:/sbin/nologin
wnn:x:49:49:Wnn Input Server:/var/lib/wnn:/sbin/nologin
named:x:25:25:Named:/var/named:/sbin/nologin
mysql:x:101:102:MySQL server:/var/lib/mysql:/bin/bash
mailman:x:32001:32001::/usr/local/cpanel/3rdparty/mailman:/bin/bash
cpanel:x:32002:32003::/usr/local/cpanel:/bin/bash
johnny:x:32003:32004::/home/dorn:/usr/local/cpanel/bin/noshell
angel:x:32004:32005::/home/angeliq:/bin/false
clamav:x:32015:32017:Clam AntiVirus:/home/clamav:/bin/false
I heard it may pose a security risk for those unneeded users. Which lines can I remove?
View 1 Replies
View Related
Oct 21, 2007
i been wonder today when i try to login my account @box by SSH 21
the password is changed i think!
and when i see the logs files there is no stranger ip!
and there is no email about changeing password for my mail!
i tried to log in by another account in my server and trying to su root permission by my password
but passwd incorect!
and i change the Mysql root passwd and same thing
my support they sleep before 3 days so i should to figure my problem alone...
how to reset my root ssh passwd?
am useing Plesk VPS ...
View 8 Replies
View Related
Apr 5, 2009
I have been googling this for a while but am not getting anywhere. Curiosity has gotten the best of me, what are the passwd- and shadow- files used for? The date and time stamps for both the passwd- and passwd files are exactly the same, as are the shadow- and shadow files.
Are they automatically-created backups of the passwd and shadow files?
View 2 Replies
View Related
Nov 3, 2007
how can i save /etc/passwd there is many linux order which show my users on server
such as :
cat /etc/passwd
cat /var/cpanel/acounting.log
ls -la /etc/valiases
ls /var/named
-----------------
and how can i disable the geting orders
such as :
wget
curl -o
lynx
View 8 Replies
View Related
Nov 8, 2008
It there any good way to stop using from reading /etc/passwd?
I have suPHP enabled and open_basedir enabled by WHM too. But it seems susphp ignores open_basedir restrictions?
Here is virtual host config:
<VirtualHost x.x.x.x:80>
<IfModule concurrent_php.c>
php4_admin_value open_basedir "/home/xxx/:/usr/lib/php:/usr/php4/lib/php:/usr/local/lib/php:/usr/local/php4/lib/p$
php5_admin_value open_basedir "/home/xxx/:/usr/lib/php:/usr/local/lib/php:/tmp"
</IfModule>
<IfModule !concurrent_php.c>
<IfModule mod_php4.c>
php_admin_value open_basedir "/home/xxx/:/usr/lib/php:/usr/php4/lib/php:/usr/local/lib/php:/usr/local/php4/li$
</IfModule>
<IfModule mod_php5.c>
php_admin_value open_basedir "/home/xxx/:/usr/lib/php:/usr/local/lib/php:/tmp"
</IfModule>
<IfModule sapi_apache2.c>
php_admin_value open_basedir "/home/xxx/:/usr/lib/php:/usr/php4/lib/php:/usr/local/lib/php:/usr/local/php4/li$
</IfModule>
</IfModule>
ServerName xxx.com
ServerAlias www.xxx.com
DocumentRoot /home/xxx/public_html
ServerAdmin webmaster@xxx.com
UseCanonicalName Off
CustomLog /usr/local/apache/domlogs/xxx.com combined
CustomLog /usr/local/apache/domlogs/xxx.com-bytes_log "%{%s}t %I .
%{%s}t %O ."
## User xxx # Needed for Cpanel::ApacheConf
<IfModule mod_suphp.c>
suPHP_UserGroup xxx xxx
</IfModule>
<IfModule !mod_disable_suexec.c>
SuexecUserGroup xxx xxx
</IfModule>
ScriptAlias /cgi-bin/ /home/xxx/public_html/cgi-bin/
DocumentRoot /home/xxx/public_html
ServerAdmin webmaster@xxx.com
UseCanonicalName Off
CustomLog /usr/local/apache/domlogs/xxx.com combined
CustomLog /usr/local/apache/domlogs/xxx.com-bytes_log "%{%s}t %I .
%{%s}t %O ."
## User xxx # Needed for Cpanel::ApacheConf
<IfModule mod_suphp.c>
suPHP_UserGroup xxx xxx
</IfModule>
<IfModule !mod_disable_suexec.c>
SuexecUserGroup xxx xxx
</IfModule>
ScriptAlias /cgi-bin/ /home/xxx/public_html/cgi-bin/
# To customize this VirtualHost use an include file at the following location
# Include "/usr/local/apache/conf/userdata/std/2/xxx/xxx.com/*.conf"
</VirtualHost>
Scripts are running with user's UID, and that is fine, but it can still read /etc/passwd file for example.
How to fix that? Is it really open_basedir value is ignored by susphp? It works fine if I remove suphp and run scripts with nobody uid.
View 10 Replies
View Related
Mar 8, 2009
I set up a new account for a client using my reseller. He went to change the password and he is getting this error
There was an error manipulating the password file. This generally means you entered your old password incorrectly.
Changing password for user xxxxx.
Changing password for xxxxx
(current) UNIX password:
passwd: Authentication token manipulation error
The thing is, he is putting the password in correct. I made sure of that
I am able to change it in whm and i am able to log in to the account, i just cant change the password from cpanel
View 3 Replies
View Related
Dec 27, 2007
We've had a customer do something strange to their server. They were playing with /etc/passwd or /etc/shadow or similar (not quite sure of the details) but the upshot is booting the server into single user and trying to reset the password via passwd gives
passwd root (and any user)
passwd: Authentication token manipulation error
So far I've
Replaced /etc/passwd* and /etc/shadow* with a copy from another server
Turned off SeLinux
/etc/pam.d/passwd is fine
Root file system is r/w
View 1 Replies
View Related
May 7, 2007
I thought I knew enough about my .htaccess stuff to do this, but I can't seem to work it out. What I want to do is if a user visits domain.com/folder, we check to see if the folder exists. If so, show as normal (IE domain.com/support)
If a user visits domain.com/dynamicusername (dynamicusername is not a physical folder), redirect to dynamicusername.domain.com
View 3 Replies
View Related
Jan 3, 2014
when I find the subscription from the admin side of PPA, if I select "Login as user" I've noticed that it is different from actually logging in as the user - for example - "add domain alias" is missing when I login as a customer - but not as an admin... I need my customers to add their own aliases and manage them - how do I add that feature to the client login side?
View 9 Replies
View Related
Jul 18, 2007
I were seeing c99.php source code to know how it gets /etc/passwd file. it simply uses fopen() for this goal but I think fopen() is needed and I don't like it to be disabled in disabled_functions. I wonder how can I disable just fopen("/etc/passwd","r"); without doing any restriction to fopen function at all
View 8 Replies
View Related
May 1, 2009
my DNS stop resolving, once a day i need to restart the service in cpanel/whm , what can be done to prevent that ?
its a fresh vps only cpanel is there and 2 domains with no pages just a simple under costruction index page . in CSF i have a Your Score: 106/112 in security , it firewalled and hardened
right now is using 299 of ram out of 512 burstable to 768
View 3 Replies
View Related
Jun 30, 2008
I was wondering if anyone has any methods to stop spammers? Currently i am keeping watch on the mail queue and making sure nothing unsual. I have in WHM configuration setup to not allow more 200 mail messages per account per hour but for some reason it will hit thousands. WHMCS does seem to suspend them automatically or maybe its because of WHM BUT only when its too late.
Any thoughts or suggestions?
View 9 Replies
View Related
Jun 2, 2009
Have a persistent spammer who kept emailing my clients, even non existent domain accounts and getting the bounced emails to be send to a particular yahoo address. I tried to block in all ways but can't seem to stop him. His spams are from all over the world. Any suggestions?
View 3 Replies
View Related
Nov 5, 2009
How to stops the scripts like c99 shell from installing into the server?
View 1 Replies
View Related
Jul 1, 2009
how to stop gunzip -c?
By mistake instead of using gunzip file name on my friend's vps, I had used gunzip -c filename
and its taking hell a lot of time to unzip it, I have no clue on how to stop this and I am scared if I close ssh client, it might be still adding load to the server ..
I am unzipping an 4.5mb file, which on un-compression must be around 14.5mb ..
for the past 10 mins its still unzipping and not sure how long it will go on.. unless I stop it..
View 2 Replies
View Related
Feb 6, 2009
a site i manage for a client is being hacked every couple of days, its not the actual site but the hosts server thats getting attacked, all sites on that server, well actually all thier servers.
They have made no attempt to sort this problem, i report it they look at the site and say "site loads fine for us" which it does.
All index files are having a base64 encode line written after the <body> tag, this adds hundreds of spam links which are hidden with display:none; they also add .html to application types in htaccess for php to run in these files too.
Problem is, i am moving the site to another host but cannot change the nameservers to the new host's untill the client returns from a holiday, so i must keep the site up on the insecure host for now.
I am removing the spam code almost daily, is there anyway i can stop this attack happening for the time being, the host does nothing.
View 14 Replies
View Related
Apr 17, 2009
I have a server that is sending spam, but I can not know who sent because the server not has installed suphp.
There is another option to see who sends spam?
View 6 Replies
View Related
Jul 19, 2009
Is there a way to stop hotlinking? I have a client who has a blog. They have post pics of tattoos. Now there are at least 50 tattoo forums, blogs and other sites hotling to the pics. Now his bandwidth usage has skyrocketed. So enable hotlink protection in his cPanel. Just did a redirect to my main hosting site with a nice please stop hotlink image. Now I see all this in my logs. So I then made a 150 x 9000 clear BG gf with the text at the top please stop hotlinking.
My questions is there any way to stop it. If not should I just make a 1x1 clear gif to redirect to? Also is there a way to not have this traffic show in my log files?
View 4 Replies
View Related
Dec 25, 2008
I want to stop emailing myself
I have received quite a few emails from senders claiming to be the recipients [in this case one of my email accounts]. I did not send these emails. This is happening with almost every email account I have setup on one of my domains.
I know this is probably an easy fix-- I am simply unsure of what it is.
I noted that someone else recently posted a similar question-- with only one response. I wanted to see if another post my garner another response.
View 3 Replies
View Related
Nov 14, 2008
I would like to ask about the best system or software code used to stop bots and offline down loaders from entering website.
View 2 Replies
View Related
May 4, 2008
to stop iptables cause when any user make refresh he is take banned from server
i need to stop iptables or how to make rules for it
View 9 Replies
View Related
Jun 14, 2008
I already enabled awstat in whm features manager.
And it was working till 3 jan 2008!
But statistic doesn't update now!
View 5 Replies
View Related
May 4, 2007
i've a vps with iptables, but i've too much traffic (RX), there are too many packets received from random ports on both upt and tcp. Today in just 14 hours i've 2.8 gib of traffic, without any connection for web, email, etc (i've stopped all the services). How can i stop this? it's going to burn all my monthly traffic
View 5 Replies
View Related
Jun 15, 2007
to stop supporting php.ini files in clients account because they can turn off safe mode or any fucntions and options and they can hack server! how i can stop supporting this files
View 14 Replies
View Related
Oct 19, 2007
For my site email address I get like 500 emails a day.
Is spam assassin really the only method?
View 7 Replies
View Related
Apr 30, 2007
I have a massive spam problem on my server, which I cannot seem to find a cure for. Here is an example of the headers from an example email (from WHM) that is stuck in the mail queue:
Quote:
1HiU0X-0006Y3-O6-Hmailnull 47 12<>1177932329 0-ident mailnull-received_protocol local-body_linecount 78-allow_unqualified_recipient-allow_unqualified_sender-frozen 1177932333-localerrorXX1vrroark@freemail.ru144P Received: from mailnull by host.zaggs.com with local (Exim 4.63)id 1HiU0X-0006Y3-O6for vrroark@freemail.ru; Mon, 30 Apr 2007 12:25:06 +0100045 X-Failed-Recipients: download@host.zaggs.com029 Auto-Submitted: auto-replied058F From: Mail Delivery System <Mailer-Daemon@host.zaggs.com>024T To: vrroark@freemail.ru059 Subject: Mail delivery failed: returning message to sender047I Message-Id: <E1HiU0X-0006Y3-O6@host.zaggs.com>038 Date: Mon, 30 Apr 2007 12:25:06 +01001HiU0X-0006Y3-O6-DThis message was created automatically by mail delivery software.A message that you sent could not be delivered to one or more of itsrecipients. This is a permanent error. The following address(es) failed: download@host.zaggs.com (generated from abraham@keysupplier.com) retry timeout exceeded------ This is a copy of the message, including all the headers. ------Return-path: <vrroark@freemail.ru>Received: from [220.157.245.77] (port=3648 helo=localhost.localdomain)by host.zaggs.com with smtp (Exim 4.63)(envelope-from <vrroark@freemail.ru>)id 1HiU0X-0006Xu-7rfor abraham@keysupplier.com; Mon, 30 Apr 2007 12:25:06 +0100Message-ID: <10fb01c78b19$683b6042$8bc8505a@freemail.ru>From: Noticeable <vrroark@freemail.ru>To: abraham@keysupplier.comSubject: I am 79 years young!Date: Mon, 30 Apr 2007 14:19:48 +0300MIME-Version: 1.0Content-Type: multipart/alternative; boundary="----=_NextPart_000_0000_9E7D5C31.01A57A34"X-Priority: 3X-MSMail-Priority: NormalX-Mailer: Microsoft Outlook Express V6.00.2900.2180X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180This is a multi-part message in MIME format.------=_NextPart_000_0000_9E7D5C31.01A57A34Content-Type: text/plain; charset="iso-8859-1"Content-Transfer-Encoding: 7bit A few words about HGH LifeI have been taking HGH Life for five weeks and there is a noticeable improvementin me overall. Waking up without muscular pain is the most obvious! WhenI run out, I shall be ordering as much as my pension will allow. I am inEngland and am 79 years young!Order HGH Life online ------=_NextPart_000_0000_9E7D5C31.01A57A34Content-Type: text/html; charset="iso-8859-1"Content-Transfer-Encoding: quoted-printable<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><HTML><HEAD><META http-equiv=3DContent-Type content=3D"text/html; =charset=3Diso-8859-1"><META content=3D"MSHTML 6.00.2900.2912" name=3D"GENERATOR"></HEAD><BODY text=3D#000000 bgColor=3D#ffffff><font size=3D"3" face=3D"Times New Roman"><p align=3D"center"><font =face=3D"Arial" color=3D"#009900" size=3D"5"><strong>A few =words about HGH Life™</strong></font></p><p align=3D"center"><font face=3D"Arial">I have been taking HGH =Life™ <strong>for five weeks </strong>and there is a noticeable =improvement in me overall. Waking up without muscular pain is the most =obvious! When I run out, I shall be ordering as much as my pension will =allow. I am in England and am <strong>79 years =young</strong>!"</font></p><p align=3D"center"><a href=3D"http://worldwdefull.com"><strong><font =face=3D"Arial" color=3D"#ff6600" size=3D"4">Order HGH Life™ =online</font></strong></a></p></font></BODY></HTML>------=_NextPart_000_0000_9E7D5C31.01A57A34--
I can confirm that the person who is doing this IS NOT using the 'nobody' user because I am keeping a spam_log for that.
How else is a user able to use our server for spam? Please help as I would like to get this sorted ASAP.
View 5 Replies
View Related
