Squarespace’s all-in-one platform gives you everything you need to express yourself creatively online, whether it is with a domain, website, or online store. Get started with your free trial today, and when ready, take 10% off your first purchase with offer code 'EXPERTS'.
I was hacked - apache -webhosting
Hi,
I have all websites on my server redirected to nonsense IP address.
1. It is not dns, since I have my clients on different registrars
2. it is not mysql because even simple pages are redirected
3. dns ping from my domains give me correct = my IP address
Heeeelp, please urgently or I am dead.
I have all websites on my server redirected to nonsense IP address.
1. It is not dns, since I have my clients on different registrars
2. it is not mysql because even simple pages are redirected
3. dns ping from my domains give me correct = my IP address
Heeeelp, please urgently or I am dead.
Asked:
-
9
-
4
- +1
3 Solutions
I checked my folders in my Inetpub and noticed that all folders have the fresh date 18 August 2: and so.
I am finding this file: .htaccess with this inside:
RewriteEngine On
RewriteBase /
RewriteRule ^(.*)? http://musikkorps.com/mainfile.php
the file is in apache, am searching for more
RewriteEngine On
RewriteBase /
RewriteRule ^(.*)? http://musikkorps.com/mainfile.php
the file is in apache, am searching for more
this file is everywhere in my inetpub folders. i am removing it but how can I prevent it for the next time?
QUESTION: since it is endless amount of this file spread in my inetpub directory, what is the crucial location, i.e. where should I go first to remove it so as the websites will function again?
Ok, the answer is to remove it from the www root.
ANOTHER QUESTION:
is there a php script available I can use to dele htaccess files from todays date in one step?
ANOTHER QUESTION:
is there a php script available I can use to dele htaccess files from todays date in one step?
To prevent this particular attack happening again, the easy fix is to add " AllowOverride None" to your apache config, this will prevent apache from using .htaccess files. If you do not use .htaccess files anywhere and want to delete them, you could just use a bash script to remove any (though it would be better to have all directories as read only for the apache user):
# find and remove all .htaccess files under /var/www
find /var/www/ -name '.htaccess' -exec rm {} \;
To make your directories read only, you could chmod ugo-w {directory} (add -r to make it recursive and change all directories). Some apps will need a few directories to be writeable, eg for cache, uploads etc, so be careful when changing directory permissions.
Have a look at http://httpd.apache.org/docs/current/misc/security_tips.html for some other good security tips.
# find and remove all .htaccess files under /var/www
find /var/www/ -name '.htaccess' -exec rm {} \;
To make your directories read only, you could chmod ugo-w {directory} (add -r to make it recursive and change all directories). Some apps will need a few directories to be writeable, eg for cache, uploads etc, so be careful when changing directory permissions.
Have a look at http://httpd.apache.org/docs/current/misc/security_tips.html for some other good security tips.
Have you checked Joomla and any of the makers of the plugins for patches to address security issues?
On windows you could make a batch file that runs
cd \your\web\root <- replace with inetpub or your webroot path
del /S .htaccess
This will recursively delete all .htaccess files (I have not tested this as I dont have a windows computer to play with, so try it first where it wont destroy things!). You could then add this as a scheduled task to run every day/hour etc
cd \your\web\root <- replace with inetpub or your webroot path
del /S .htaccess
This will recursively delete all .htaccess files (I have not tested this as I dont have a windows computer to play with, so try it first where it wont destroy things!). You could then add this as a scheduled task to run every day/hour etc
You could write the htaccess stuff into the virtual host configurations for apache, instead of using htaccess files, it sounds like these may have been overwritten anyway, so it may be time for restoring your backups. Another way around it would be to restore the .htaccess files, then use windows file permissions to remove write access to them. If you cannot avoid htaccess files, restore and permission is the only way I can think of to get around this.
is there a way how to forbid overwritting .httaccess in general config of apache?
(I have windows).
I do not want to do it od windows folder level manualy since I have a lot of files.
(I have windows).
I do not want to do it od windows folder level manualy since I have a lot of files.
Question has a verified solution.
Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.
Have a better answer? Share it in a comment.
Join & Write a Comment Already a member? Login.
Featured Post
Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.
Tackle projects and never again get stuck behind a technical roadblock.
Join Now
I would suggest you to check you website pages as it might possible that someone injected malicious scripts in them. Also scan your server for viruses or any backdoor.