Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a client with a lot (read several thousand) websites in several old cms solutions that are no longer maintained. Now moving all of them to a maintained solution isn't really an option at this point. So I'm thinking about ways to secure the solutions without patching them.

The solutions are mostly joomla 1.0/1.5 and wordpress. What I'm thinking is something like this:

  • mod_suexec to lock everyone into their own home directory
  • apparmor to deny any and all file writes by default. (exclude by default, include things like "images" directories).
  • use htaccess to prevent anything in writable directories from being executed. (aka disable php_engine for images/ directory).
  • mysql triggers to check the "users" tables to prevent adding new admins/superadmins.

Does this make sense? Is it viable? Am I missing something obvious?

//Edit: Yes, I know it's a horrible idea. I know it can't be made secure. I've informed the client about this VERY clearly. What I'm looking for is a way to setup a temporary solution until these clients can be phased out. The alternative (that he's already doing today) is to wait until individual sites get hacked, restoring them from backup and upgrading them manually.

//Edit2: Alternate idea : Take every php script on the site as per today, and setup apparmor so php can execute them, but nothing else. If I at the same time make them read only that should lock the sites down pretty well.

share|improve this question

migrated from serverfault.com Aug 30 '12 at 9:58

This question came from our site for professional system and network administrators.

2  
Securing it without patching the security holes? Unplug the network cable. That's about the only way you can be sure. –  Michael Hampton Aug 29 '12 at 9:08
2  
Does it make sense? Absolutely not! Yes you have missed the obvious - patch them. Inheriting an unpatched system is one thing. Leaving it that way to save a little work is something else altogether. –  John Gardeniers Aug 29 '12 at 9:46
    
Fully aware that this is a horrible idea. And I'm not trying to save myself time, I'm trying to offer the client a temporary solution until he can phase out these clients. –  neuron Aug 30 '12 at 8:37

2 Answers 2

If you are trying to save yourself the effort, there's not much I can do to help you.

Otherwise if the issue is resources, I would suggest looking up vulnerabilites and making a report to present to management so in the worst case scenario that you aren't allowed to upgrade, at least you have covered yourself.

share|improve this answer
    
I've made it CRYSTAL clear that it's not a matter of IF the sites get hacked, it's a matter of WHEN. –  neuron Aug 30 '12 at 8:45

Beside the fact that you should realy upgrade to a non vulnurable system/cms, have a look at mod_security - http://www.modsecurity.org/

share|improve this answer
    
Might be a good option, I can hand setup rules and allow only wanted requests. Wasn't aware of that module :) –  neuron Aug 30 '12 at 8:45
2  
True, but considering how insecure these systems seem to be, I would go for a stronger, standalone WAF (web application firewall). You need the isolation here, whereas modsecurity runs inside the webserver. Also, there are stronger, more robust, more capable products out there (but more expensive, too). –  AviD Aug 30 '12 at 9:38
    
+1 mod_sec2 in a (transparent?) proxy in front of the whole server farm could, with some tuning, protect against most common attack techniques. –  adric Aug 30 '12 at 12:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.