2 replies to this topic

[Bluesplinter]

What is the best set of perms to prevent scripts from tinkering with an .htaccess file (including the control panel, DA in this case)? I had installed a forum script in a private subdomain, protected with .htaccess. When I found the forum software unacceptable, I deleted the files via the DA control panel before installing a different script, which (of course) deleted the .htaccess file, and the private subdomain was no longer so private. Luckily I discovered the problem quickly, but it brought this question to mind.

Since this is a cloud server, and I have SSH access, I can change the perms and owner:group to whatever will work best. Mostly, I don't want any php script to be able to alter the file, nor be able to delete it from the DA control panel. I know if it's set to root:root, DA can't delete it, but I don't think it'll actually WORK with that owner:group. So, what's the best way to handle this?

FWIW, I would normally just put the auth code in the httpd conf vhost section, which is off-limit for scripts, but then the DA password function won't work (or is that wrong?).

Anyway, thoughts?

Thanks!
Steve

P.S. Goodness... looks like I'm monopolizing this forum
 monopoly.png   83.34K   5 downloads

[CH-Jonathan]

Hi Steve,

You can use chattr +i <whatever you want to chattr> to set the immutable bit on a file - which makes it read only to everything (even root) until the file(s) is/are re-owned (chattr -i).

Bluesplinter, on 01 June 2010 - 11:10 AM, said:

What is the best set of perms to prevent scripts from tinkering with an .htaccess file (including the control panel, DA in this case)? I had installed a forum script in a private subdomain, protected with .htaccess. When I found the forum software unacceptable, I deleted the files via the DA control panel before installing a different script, which (of course) deleted the .htaccess file, and the private subdomain was no longer so private. Luckily I discovered the problem quickly, but it brought this question to mind.

Since this is a cloud server, and I have SSH access, I can change the perms and owner:group to whatever will work best. Mostly, I don't want any php script to be able to alter the file, nor be able to delete it from the DA control panel. I know if it's set to root:root, DA can't delete it, but I don't think it'll actually WORK with that owner:group. So, what's the best way to handle this?

FWIW, I would normally just put the auth code in the httpd conf vhost section, which is off-limit for scripts, but then the DA password function won't work (or is that wrong?).

Anyway, thoughts?

Thanks!
Steve

P.S. Goodness... looks like I'm monopolizing this forum
monopoly.png

[Bluesplinter]

Hey Jonathan,

CH-Jonathan, on 01 June 2010 - 11:43 AM, said:

You can use chattr +i

Yeah, works perfect! Thanks
Steve