?
Solved

website file permissions

Posted on 2014-07-28
4
Medium Priority
?
104 Views
Last Modified: 2016-05-23
Hi

I'm running a LAMP server with Centos 5, CPanel, SuPHP, Mod_Security, CSF etc. The website is being hacked with eval(Base64_decode(... being inserted into some php script. Also other .php script pages are being created in some of the website directories. I understand from research that this is a common hack. I am looking for techniques to improve protection of my site to prevent this.

I assume that there must be a problem with my file owner,group and permissions settings for an external user to be able to modify the code on pages and to create script pages.

My question is about what those settings should be. Currently I have :-

Drectories - owner and group are set to the same. This is the user name of the ftp user that I use to upload changes to the site. The permissions are set to 755.

Files - owner and group are set to the same. This is the user name of the ftp user that I use to upload changes to the site. The permissions are set to 644.

Apache- httpd.conf is set to use nobody as both user and group.

SuPHP - the UserGroup directive in httpd.conf is set to the same user/group as my files and directories.

I have googled about this topic and so I understand with Apache set to nobody, website users should be using the 'other' permissions on files and directories. This would mean Read access only. However SuPHP uses the permissions of the file owner/group when executing php pages. This means read/write permissions. This is meant to be safer but does not seem so as it allows php pages to be modified.

Clearly I have a gap in my understanding and would welcome some advice to stop the hack.

BTW : I have looked into preventing base64_decode in php.ini but it is used legitimately on the site at the moment. I have also looked into using Suhosin to disable eval() but again that is legitimately use in some places too.

Any help and advice would be very appreciated.

Phil
0
Comment
Question by:philevans114
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 83

Assisted Solution

by:Dave Baldwin
Dave Baldwin earned 664 total points
ID: 40226089
You should make your users change their passwords because it is possible the attacker has a legitimate login that they are using.
0
 
LVL 62

Assisted Solution

by:gheist
gheist earned 664 total points
ID: 40228491
normally apache should not be able to write web content.
so permission must be o-wx


apache on centos5 by default uses credential "apache:apache"
primitive suggestion: remove your overcustomized apache and install one shipped with system....
0
 
LVL 2

Accepted Solution

by:
Richard R earned 672 total points
ID: 40260854
This is a problem with one of your website coded pages (php files). You might be vulnerable to some type of hacking.
However SuPHP uses the permissions of the file owner/group when executing php pages. This means read/write permissions.
If your file is vulnerable and the hacker gets access to the file, he will be able to write to any other file within that user's account, because of suphp making it possible. When running suphp, all files should be 644, and all folders should be 755. The point of suphp in cPanel is so that one user won't be able to access other user's file, they are isolated from each other.

I've dealt with cleaning up many hacked servers with this same issue, and same cPanel setup. Make sure you get your programmer to look through the code, 99% this is your code's fault and not file permission as you are thinking.

Let me know how it goes.
0

Featured Post

How To Install Bash on Windows 10

Windows’ budding partnership with Canonical has certainly led to some great improvements. One of them being the ability to use Bash on your Windows machine without third party applications! This might be one of the greatest things a cloud engineer in a Windows environment can do!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction This article explores the design of a cache system that can improve the performance of a web site or web application.  The assumption is that the web site has many more “read” operations than “write” operations (this is commonly the ca…
Fine Tune your automatic Updates for Ubuntu / Debian
The viewer will learn how to look for a specific file type in a local or remote server directory using PHP.
The viewer will learn the benefit of using external CSS files and the relationship between class and ID selectors. Create your external css file by saving it as style.css then set up your style tags: (CODE) Reference the nav tag and set your prop…
Suggested Courses

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question