Zikula Community

• manarak
  
  

  • Rank: Helper
  • Registered: Dec 31, 1969
  • Last visit: May 20, 2010
  • Posts: 524

  Posted: Jul 18, 2005 - 01:00 AM

  Hello
  
  I have setup a new server with galleries, file uploads, fori, etc.
  
  Can someone please test my security measures that I took to defend the server against script-kiddie standard-attacks (against wget execution in /tmp, rootkits and other SQL-Injections)?
  
  If you can do those things to Postnuke, please post or PM me.

  • 
  •  
• manarak
  
  

  • Rank: Helper
  • Registered: Dec 31, 1969
  • Last visit: May 20, 2010
  • Posts: 524

  Posted: Jul 18, 2005 - 06:41 PM

  nobody?

  • 
  •  
• larsneo
  
  

  • Rank: Software Foundation
  • Registered: Dec 31, 1969
  • Last visit: Oct 21, 2009
  • Posts: 3814

  Posted: Jul 19, 2005 - 01:21 AM

  maybe nobody knows about current wget/rootkits/sql-injections within the current release build - at least i hope so
  since a full code auditing is very time-consuming i doubt you'll find someone.
  
  BTW: even some basic config-settings like register_globals=off and magic_quotes_gpc=on will improve the security quite nicely - most of the known exploits won't work under those circumstances...
  
  --
  regards from germany
  ..::[Zikula Application Framework]::.. ..::[SEO-Blog]::.. ..::[CMS Sicherheit]::..

  • 
  •  
• manarak
  
  

  • Rank: Helper
  • Registered: Dec 31, 1969
  • Last visit: May 20, 2010
  • Posts: 524

  Posted: Jul 19, 2005 - 01:53 AM

  yes, but then you run into problems with other modules, such as gallery (requiring magic quotes off, if I rember well), or oscommerce (requiring register globals to be ON), uploads (requiring safe mode being off), and and and...
  
  I have made some server configurations which should hold off some of the stuff (and installed mod_security) - I would like to know if it works and helps?

  • 
  •  
•  
•  

Users on-line

• roccoluigi,
• slam

This list is based on users active over the last 60 minutes.