New answers tagged

1

These are NOT lines: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA These are ciphers and should go inside the SSLCipherSuite in appropriate form. Implementation: First, make sure that there is no other SSLCipherSuite (except vhosts) that may override your new cipher suite settings. If there is, ...


1

The same "vulnerability" is in C, Java, Perl, Ruby, Lisp, Fortran, BASIC, PASCAL, ALGOL....programming languages almost universally provide a construct for reading files. Some files on a Unix system are world readable. I do not have control on developers about what code they are uploading... Then by all means try to mitigate silly mistakes, but don't ...


0

You can restrict which directories PHP scripts may access using the open_basedir configuration. e.g. putting open_basedir = /var/www/ in your php.ini file should restrict PHP to /var/www/


0

One way to stop Apache from reading system files (and, in general, any file outside the web root directory) is with SELinux. Its whole purpose is to prevent inappropriate access to system resources (not restricted to constraining Apache, but that sort of protection is one of its great benefits). You would need to use an operating system that supported it, ...


3

This is not a vulnerability in Apache. It is a vulnerability in your PHP code. The function include(x) includes the file x. If you let the user pick any x, they will be able to include any file. If you don't want them to be able to do that, then don't write PHP code that lets them. I suggest you only pass constants or values from a whitelist as parameters ...


0

I managed to trace the files without rebuilding the whole server which are sending spam emails. This is probably happening because of any PHP script that is running on your server. Usually hackers are deploying these scripts that are using eval() methods to execute the php mail code randomly. I found Files with name such as db.php functions90.php ...


4

For testing and developing I allowed all Headers. ... It is not very clear what you mean here (maybe be more specific and do not only dump the config) but... Header set Access-Control-Allow-Origin "*" Header set Access-Control-Allow-Credentials "true" It is definitely not a good idea to allow cross origin access from everywhere. And it ...


4

CloudFlare's Origin CA is working as intended. It's not trusted by browsers. It's only trusted by CloudFlare's servers. Its purpose is to secure communications between CloudFlare and your origin, not for general usage. Reference: Introducing CloudFlare Origin CA If you want a free, publicly trusted certificate, check out Let's Encrypt. (It's a legitimate ...


6

Don't waste your time trying to maintain GeoIP blacklists. It's a kneejerk response, and is shortsighted and ineffective in practice. Think of it like terrorism-- Timothy McVeigh detonates a bomb in Oklahoma. You ban all white men from America. Does that really stop the problem? The majority of actual attacks I've seen come from botnets and/or anonymous ...


17

Banning ranges of IPs is generally not a good idea. You should only do this if a range is consistently a big problem for you. Here's why: Many people use VPNs or anonymizing networks such as TOR, meaning valid users may appear to have an IP from a country you don't consider to be part of your target audience. Users of such networks may not use your ...


40

It's essentially a business decision, rather than a security one. The risks from a business perspective are that you lose users from that country, or who are accessing the site from VPNs located in that country, and that, whilst really unlikely, it's theoretically possible for IP assignments to change, meaning that if you didn't keep these blocks maintained ...



Top 50 recent answers are included