website file permissions

Hi

I'm running a LAMP server with Centos 5, CPanel, SuPHP, Mod_Security, CSF etc. The website is being hacked with eval(Base64_decode(... being inserted into some php script. Also other .php script pages are being created in some of the website directories. I understand from research that this is a common hack. I am looking for techniques to improve protection of my site to prevent this.

I assume that there must be a problem with my file owner,group and permissions settings for an external user to be able to modify the code on pages and to create script pages.

My question is about what those settings should be. Currently I have :-

Drectories - owner and group are set to the same. This is the user name of the ftp user that I use to upload changes to the site. The permissions are set to 755.

Files - owner and group are set to the same. This is the user name of the ftp user that I use to upload changes to the site. The permissions are set to 644.

Apache- httpd.conf is set to use nobody as both user and group.

SuPHP - the UserGroup directive in httpd.conf is set to the same user/group as my files and directories.

I have googled about this topic and so I understand with Apache set to nobody, website users should be using the 'other' permissions on files and directories. This would mean Read access only. However SuPHP uses the permissions of the file owner/group when executing php pages. This means read/write permissions. This is meant to be safer but does not seem so as it allows php pages to be modified.

Clearly I have a gap in my understanding and would welcome some advice to stop the hack.

BTW : I have looked into preventing base64_decode in php.ini but it is used legitimately on the site at the moment. I have also looked into using Suhosin to disable eval() but again that is legitimately use in some places too.

Any help and advice would be very appreciated.

Phil
philevans114Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dave BaldwinFixer of ProblemsCommented:
You should make your users change their passwords because it is possible the attacker has a legitimate login that they are using.
0
gheistCommented:
normally apache should not be able to write web content.
so permission must be o-wx


apache on centos5 by default uses credential "apache:apache"
primitive suggestion: remove your overcustomized apache and install one shipped with system....
0
Richard RCommented:
This is a problem with one of your website coded pages (php files). You might be vulnerable to some type of hacking.
However SuPHP uses the permissions of the file owner/group when executing php pages. This means read/write permissions.
If your file is vulnerable and the hacker gets access to the file, he will be able to write to any other file within that user's account, because of suphp making it possible. When running suphp, all files should be 644, and all folders should be 755. The point of suphp in cPanel is so that one user won't be able to access other user's file, they are isolated from each other.

I've dealt with cleaning up many hacked servers with this same issue, and same cPanel setup. Make sure you get your programmer to look through the code, 99% this is your code's fault and not file permission as you are thinking.

Let me know how it goes.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Web Servers

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.