Chris W
l33t
Joined: 25 Jun 2002
Posts: 972
Location: Brisbane, Australia
|
 Posted: Wed Mar 17, 2004 5:40 am Post subject: phpwebsite security weakness |
 |
|
I'd like someone to idiot check me before I post a bug.
I've just installed | Code: | # qpkg -I -v phpwebsite
net-www/phpwebsite-0.9.3_p2-r1 *
|
and followed the ebuild instructions to secure the server after install (used group apache rather than users but that's not relevant to the problem). The secure_phpws.sh script leaves the entire phpwebsite tree scannable by anyone and the config.php, which contains two clear text passwords, world readable: | Code: |
ptolemy phpwebsite # pwd
/var/www/localhost/htdocs/phpwebsite
ptolemy phpwebsite # ls -l conf/
total 9
-rw-rw-r-- 1 apache apache 239 Mar 17 14:55 README.txt
-rw-rw-r-- 1 apache apache 314 Mar 17 14:55 allowedImageTypes.php
drwxrwsr-x 2 apache apache 1024 Mar 17 15:10 branch
-rw-rw-r-- 1 apache apache 941 Mar 17 14:55 cache.php
-rw-rw-r-- 1 apache apache 348 Mar 17 15:07 config.php
-rw-rw-r-- 1 apache apache 79 Mar 17 14:55 core_info.php
-rw-rw-r-- 1 apache apache 356 Mar 17 14:55 dateSettings.en.php
-rw-rw-r-- 1 apache apache 1217 Mar 17 14:55 textSettings.php
ptolemy phpwebsite # ls -l
total 22
drwxrwsr-x 2 apache apache 1024 Mar 17 14:55 admin
-rw-rw-r-- 1 apache apache 273 Mar 17 14:55 article.php
drwxrwsr-x 3 apache apache 1024 Mar 17 15:10 conf
drwxrwsr-x 4 apache apache 1024 Mar 17 14:55 convert
drwxrwsr-x 3 apache apache 1024 Mar 17 14:55 core
drwxrwsr-x 3 apache apache 1024 Mar 17 14:55 docs
drwxrwsr-x 5 apache apache 1024 Mar 17 15:10 files
drwxrwsr-x 14 apache apache 1024 Mar 17 15:10 images
-rw-rw-r-- 1 apache apache 4726 Mar 17 14:55 index.php
drwxrwsr-x 3 apache apache 1024 Mar 17 14:55 js
drwxrwsr-x 4 apache apache 1024 Mar 17 14:55 lib
drwxrwsr-x 4 apache apache 1024 Mar 17 14:55 manual
drwxrwsr-x 31 apache apache 1024 Mar 17 14:55 mod
-rw-rw-r-- 1 apache apache 1362 Mar 17 14:55 mod.php
drwxrwsr-x 5 apache apache 1024 Mar 17 14:55 setup
drwxrwsr-x 2 apache apache 1024 Mar 17 14:55 templates
drwxrwsr-x 14 apache apache 1024 Mar 17 14:55 themes |
To my way of thinking the files should belong to root, be in the apache group with read-only permissions and have no permissions to other i.e rwxr----- for files and rwxr-x--- for directories. For the directories that must be written by the web server the apache group should have rwx permissions and the set-gid flag set i.e rwx-rws---.
_________________
Cheers,
Chris W
"Common sense: The collection of prejudices acquired by age 18." -- Einstein |
|
Networking & Security
