I have developed a website with php and apache server on linux centos I am not professional on security issues and I think some folks try to hack my website first please advice me which security things I should follow  but my problem: tonight as I tried to login firebug showed it tries to load login.php for serveral times but a file error occurs (I think a permanent move or something....) anyway when I checked the login.php file in linux I have noticed the file permission has been changed and all x (execution) flags has been removed.  could it be the work of a hacker? what should I do to prevent such happening.  I changed chown to root, and also set chmod of all files from 775 to 755 please give more
281
This is a  about Server Security - Responding to Breach Events (Hacking)   See Also:                  Canonical Version I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:   What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations? How do I go about getting services back online? How do I prevent the same thing from happening immediately again? Are there best practices or methodologies for learning from this incident? If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?   Original Version       2011.01.02 - I'm on my way into work at 9.30 p.m. on a Sunday because our server has been compromised somehow and was resulting in a    attack on our provider. The servers access to the Internet   has been shut down which means over 5-600 of our clients sites are now   down. Now this could be an FTP hack, or some weakness in code   somewhere. I'm not sure till I get there.      How can I track this down quickly? We're in for a whole lot of   litigation if I don't get the server back up ASAP. Any help is   appreciated. We are running Open SUSE 11.0.            2011.01.03 - Thanks to everyone for your help. Luckily I WASN'T the only person responsible for this server, just the nearest. We managed   to resolve this problem, although it may not apply to many others in a   different situation. I'll detail what we did.      We unplugged the server from the net. It was performing (attempting to   perform) a Denial Of Service attack on another server in Indonesia,   and the guilty party was also based there.      We firstly tried to identify where on the server this was coming from,   considering we have over 500 sites on the server, we expected to be   moonlighting for some time. However, with SSH access still, we ran a   command to find all files edited or created in the time the attacks   started. Luckily, the offending file was created over the winter   holidays which meant that not many other files were created on the   server at that time.      We were then able to identify the offending file which was inside the   uploaded images folder within a  website.      After a short cigarette break we concluded that, due to the files   location, it must have been uploaded via a file upload facility that   was inadequetly secured. After some googling, we found that there was   a security vulnerability that allowed files to be uploaded, within the   ZenCart admin panel, for a picture for a record company. (The section   that it never really even used), posting this form just uploaded any   file, it did not check the extension of the file, and didn't even   check to see if the user was logged in.      This meant that any files could be uploaded, including a PHP file for   the attack. We secured the vulnerability with ZenCart on the infected   site, and removed the offending files.      The job was done, and I was home for 2 a.m.            The Moral   - Always apply security patches for ZenCart, or any other CMS system for that matter. As when security updates are released, the whole   world is made aware of the vulnerability.   - Always do backups, and backup your backups.   - Employ or arrange for someone that will be there in times like these. To prevent anyone from relying on a panicy post on Server   Fault.
68049
Has anyone got a nice solution for handling files in /var/www? We're running Name Based Virtual Hosts and the Apache 2 user is www-data.  We've got two regular users &amp; root. So when messing with files in /var/www, rather than having to...  chown -R www-data:www-data   ...all the time, what's a good way of handling this?  Supplementary question: How hardcore do you then go on permissions?  This one has always been a problem in collaborative development environments.
29983
I'm having a problem setting up a vhost on Apache 2.4, using CentOS 6.3.  This question seems to have been answered several times on this forum, but none of the solutions work for me.  Basically, I set up a vhost with a particular document root. When I attempt to access the site, I get a permissions error. But I have no problem if I use a different root.  More specifically, if I set the root to be /volume1/web/xxx, I get a 503 because of a permission problem on index.html.  But if I set it to be /volume1/web, the index.html comes up without a problem.  The details:   I set the persmissions on volume1, web, and xxx to 755. I set the permissions on the index.html files to 777. I copy the index.html file to both /volume1/web and /volume1/web/xxx, so that they have identical index files with identical permissions.   In httpd.conf, I set the VirtualHost options so that I can easily switch the document root by changing 2 comment marks  I have the following lines in the conf file:  NameVirtualHost *:80  &lt;VirtualHost *:80&gt;     ServerName localhost     #DocumentRoot /volume1/web     DocumentRoot /volume1/web/xxx      #&lt;Directory /volume1/web&gt;     &lt;Directory /volume1/web/xxx&gt;       Options Indexes FollowSymLinks Includes ExecCGI       AllowOverride All       Order Allow,Deny       Allow from all     &lt;/Directory&gt;      ErrorLog logs/localhost-error_log     CustomLog logs/localhost-access_log common &lt;/VirtualHost&gt;   These lines contain all the suggestions that worked for other people with the same problem.  What I get when I enter localhost in my browser depends on the document root.   If the root is /volume1/web, the index.html page comes up. if the root is /volume1/web/xxx, then I get a 503 error, and the apache error log has this line:  [Thu Jul 19 17:17:52 2012] [error] [client ::1] (13)Permission denied: access to /index.html denied   I also tried adding an index.php file to the directory. I then got permission denied messages for both the php file and the html file.  I also tried setting the user : group to apache : apache on the directories and files. That didn't help.  I've done everything I can think of to fix the permissions, to no avail.  Does anyone have an idea about what's happening here?  Thanks.
7868
Let's say I have a file called run.sh that contains:  #! /bin/sh -x  x-www-browser index.html   And ls -l run.sh says:  -rwxr-xr-x 1 myusername myusername 39 Jan  9 19:32 run.sh   And ./run.sh says:  bash: ./run.sh: Permission denied   Why does it not work? Why does sh -x run.sh work perfectly?    More info, since it's not so easy apparently  If I do a sudo, it will not output an error, but won't do anything either.  myusername@crunchbang:/mnt/data$ sudo ./run.sh [sudo] password for myusername:  myusername@crunchbang:/mnt/data$
123152
When I access a directory hosted by Apache that does not have a index.php file or similar, Apache lists the content of the directory for me. How can I block this? I'm using Apache2 on Ubuntu.
89671
I have a shell script called boot.sh on an Ngnix server  I am trying to call it via PHP, but I don't think I have permissions.   How can I give www-data permission to run boot.sh - and only boot.sh  When trying sudo chown or sudo chgrp I am getting Operation Not Permitted
96562
I tried restarting the Mysql server but its not working for me. I am sure the server is running and the permissions on the folder /var/lib/mysql/ are correct (777).  When i tried to open the file mysql.sock, its giving me an error saying the file may be corrupt.  Please help me to log on to the mysql server.
70595
My site working very effectively on my localhost, but when I move the working site's all folders and files to Live Server i.e to cPanel, Its only display unexpected symbols that are given below.  ‹Ý0M™å‘/ðë¥R!ŒH6L¨½¯Tl³/)4-/`4A‹.iÌ$³·†1‚š–b·Ê¹¢jZ-"¯i!¶=Ç¡Wô¶Ö¢c.kžu›pW:W_R–ÚF½¶™Õj!jWÒj5ƒ°µöÃb‚¹hB:=ú…4Íçÿ Ÿ&gt;ÿ’ubK-NeýS¥#™Ú÷&lt;‘FªR%•ûöËÝÍÍ—õm{£òùÅ&lt;CR€u"Ôµ±/”hŒJ¨w}F{¼”Zï¦‘‡oýùZ,Oä¿G{ð&amp;i:¯y`ðŠkë#o¥ F`xMû&amp;©Lh¥26ˆÊaäÁ(•¤l¬æ š×+8]r¯Bš%êðÐ¸¢Zœ%&lt;_I6Ðq¤*dÏÔ¡zssSyAþƒT²É¶iDƒ¡âž™r t%K,¡¨²,i©LLùzxI{¨å‘ÀŸêŸG°²ƒ#ˆÔ    ¬Ë$KÔk¾„­÷À;ÈB;ß^¬gå‘%éZÀ£kÒOX·™sß—“fêIùk—†&lt;6©{[õzuÃüçà5¸W} µ—Em«(½‚öWEm·^¯„ÍŠv²Ï˜ªS6“„*°iY2qh·HÈ|NÁõÕúG§¤HšëÖHñµ’):à­R âÈ¡–}j.•¬†E»êv×µ@1G³”Êb“–ÈêÂ¶N€Ê]™’q'”±P‹ØM¹ø‘¦1Ãº‰+n;Øûxm%ø}ð0úG,_VŒ6q;zVLsÌ½k–Ô6j¯1ç]Îß`5å•pˆl›Â½ÆkàUÏÜ'¬00Ø½~öY‰¬©Ëœ”“z´XRVŽ6?õÊÅ•“€È&amp;aEaµè!Î‹c¹}ËìóˆÉL%j[®HÓ]Htd¦ôÜ®/wI†,qÖ¥i F®*kèèþÕøDqºÙW3ß`þ©êˆ.Úw=Y.½fž2ëÌKZÖñ¦GÉ&lt;Ÿˆ9$Ø¡pù#gk&gt; W%!:Žçèt©#ÆÔ"ƒƒU~–¸’¿šµ­ÚVù&lt;±"ä"òXNas•øý$i€¨3Õ¬·&gt;i¦_Õ6WÅõrQËªåQ‡C%œÙyÙ)…lÒòºmŽ™OÅÉ”s¼•Ÿ“ìý|ò÷ÑC'ÔÚwùõ'Ygçô8Ú&lt;áZ›í_¯ò´J- .xwø„*¾‹…œ€õ‘â;°`Ð|Ê£íí» ‡ƒþmÛql»ÕøñÓÁáþåþ'ÇiaãÚÕ_õ´‹üõC³OI¦”I„~µ0ÑpFUßÚ³ÚŽUµb(Ÿ%¬Ëo¡ê¸ý`FìBUX{_--ô#uGG‰kA÷ÎÇƒóð ÷ã«wÿ•þ&gt;è½ ¶w½_Þ~&lt;Œ/6?ü1ŒÞ}8í¥ÁÕ[  °WQã:l"ko£:Þ–mà¥Žbç-µe;¦nÑúoã´s÷ÒßÝÚS›Ý`±KÆ–K³7ª»Éd©vO³?´ó ¢=‡X–Ü»Ï‡›ðÃíŽ¹4 %‡:…Ò,†öÄj0üL;Ã‡€—ÙRà…Z ªì@XXÍ·ª…\¹âM¢¬=™4Êž3¨HúÝ1j”Ì[8°HÒÍ7Q­=‘S{àR\‰“Û.ò`í"v/âÍÌt’k\:_• o²WóI%¢ÚÓy©qôFö1‘GJÕù£v)´`}fùv‘j¥ˆî   ™e|ÚÙŸ{BëtN{,±sÈ}KÞŸÌƒ˜9?È&gt;÷ðU Ó!”Ù&amp;lýDK¿\Ù‹DÄòÉrŒ¼wjÿžÊï#:£|R¿[ý\hD¼§ùö Ûs]èŒ­æeŽ`s‹À¶4tŠ&lt;ì¾6:òÉQwä‰~€ÿ²ž¿áyQKÅpümÓfLå'Ù7x†¬¼¨yœf«á+Ûp#%ºÙ%Ä [·@ÿ /¡ôØoY!ûŽ¿ð)Ià¦øÚŽp¿iåXD?‹lZƒµ(ˆG4°Ç›•&amp;«uÐ"¶¬9seN­   UP’Cú¸§Ë˜FÅÞ Vk#\ë÷£“äŸÿìC7î³†ß‰i79ó—S#%Æ Ê––r¬nÊ”Œ",–Ð J5)­ÓViavy"a· ’Ï|â'"öÅY§ÙR„¹ˆ;" 8.Ï,—©ob ,ãÓð“Õº\ãú…•É”ŽíP«zmŽ$*ÈÌábÈîZÑ—}FD4‡Ï äß­Ó4!X¼×"(´š0†úÄÏR€×È‚f…ûOhŒc«u†Ÿ»&amp;o¶ô¿ø,åÐÎq!‚²&amp;£ÂÖkhÏÜ½¬CŸ7=e§_‡Õ*McÑ¢AÌÚ5˜Âl}cqáæ–5¬ÍPÚû¤dó` ¢žQü37öqëâòã#²rHÞì_¼{zBÞœž“w§¿5œx;S•¢˜LÞó ivtà`AŒ(f[zI–IxžLÃßÌ+õ9ÆªsYF=›£;%ý¬«´d   §5¼µ¡a  Má˜Ð!   „ˆg…ý ~Çc;/³Pã-+‹guƒƒ Ï@ë8]lxº7Ì Ç  ë–™”…{–«ÝÈÊTm~¯Éz¹Y‡c˜Îm6­Í­úœcgƒ….øÇÉ.oºh8šØLM8F3¬ÖÑ¨§Ì}F„¾8hÏVÔÏ¥Õ×ÎÊ¥Q„âåÔ¬ˆõ§ýó÷ót]J&amp;¤¡-K%þ.Üá!œÓî“NÌ_u9&gt;·É!í3ù€Î†9$Ï?Ò—·§¾¸PÍ7¨ùP%…¸B¹â@ïÈf”Ev]ˆ   ÈduYYÃ!^gø¾ß©ß%å´=˜fúcšÌ&amp;Ü{“Êö&amp;Ø_‹mj´/¹ø«iáÿÑÍéUi) Ì-LpüÂò‹i´–fÇyk‹­ñéãRZ`RùË¡¤=]éB›g°K­»©·¼t1œå6Æáf³ùÀe5Ó°vfÖtÙ¬&amp;Oókw»¸g6ª3Œõ¹wžöì×‚ª•ûð9æõ×¾#ƒùHô\,s.ÇKÛÚ]æ¶5Ó=(0ö8ÓË/’¦.Ë²_áÖW0w;¼ïnŸû‘×É1lI×Ççwïÿ¼&amp;ºí¦RD]æê© ôóÜ~o8K`UàwüîŸÑüâÄ÷”„ åÿ¹c¼IÂb&amp;žÍðVÝv…POðšcc³dÿ†FÄsB[¼…Û|l3ÚÆß&gt;7f2ÏiD'-ñí‚¥SH‚ÂaÊüÜšÁq!ÓÌ¾,16S¦9I7)‰S®Ìºb”Kç §¯ŠÜ`œðõ†¶ÄgßxYˆ9YÝD.ò¦±Äé\ ÄPÚPó¹¾ˆ±Z—ØBþ†ñ/ä h¿/¾¬+ÀÎ_ ‚kPiÙ±¸7Ä+&amp;ÓžÑ8×½äL÷N¤9—°Ò¼_Ö§–Y‹mÏ0õÙ¶¸1f‹*b7šÈ4ô»güS+x;Añíû(NÕQHy°’¥.ÞœºŒ(ADš|c0|cB!lëN‹,oÖ£‡½ööŸÂ¶Iþ'uÀƒ$a‘g±)sY„j9ñ  ™ê*RùJ FTÄB”Çbe{}šHŒ±&gt;\¾±w,­æ1]ëñà’C¢K˜Ã³ñ^¿&amp;E¯3i_žkXYÏ‘þŽïD:Á?ö’0¿¸¿ìs&lt;1#z(äÝ5«õïÅu1   °YŽVTz`„‘ÍþŠ)hê›uÉÿ_ÌÅ…ô´ÓÃÜÜÆæŽ5Æâ##î\4fí”©ÂDÀ!ªD7o0”E\Ð½MY™L&gt;ÞiáísßgQŽGvÜ”~ö‹£†?&lt;¦    lÀ'[gþßøûm/¾Ýýø×ôìXþöúUxö·íŸÅîéÉka„¸ƒJ  ÿÈx:Úx:zÀvI ›ZÚ\×™µY&gt;ÜóLÄ-žˆ‡ÙMÊ?ÿ›Œÿ‰©r ³v¶!7|ªïKðdý/oþŽ¿;K   I also change the permissions of index.php but nothing works for me. Also my index.php works, when I write die('test') in index.php it displays "test" on the page. I think the problem is in these two lines of code in index.php,  drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL); menu_execute_active_handler();    If any one know how to fix this error, Please let me know I'll be very thankful to all of you. Thanks in Advance...
927
I've installed XAMPP Apache server and put my website into htdocs. I've started Apache server. On my website I've got files with extension PHP and with extension PHP5.The difference is that when I type in into browser localhost/file.php - I see a parsed website.  But when I type localhost/file.php5 (i have this file on server), than browser asks me if I want to download or open this file. And if I choose open than I see PHP code of file.php5!  I've looked into configuration, so:   I dont have htaccess file PHPINFO() shows PHP 5 c:\xampp\apache\conf\extra\httpd-xampp is included into configuration and has this on the beginning:  AddType application/x-httpd-php-source .phps  AddType application/x-httpd-php .php .php5 .php4 .php3 .phtml .phpt   I've tried also to put:  AddHandler php5-script .php5 AddType text/html .php5   Into httpd.conf, but it does not work for me (no changes).  Could you please help me fixing it? I would like to have php5 and php extension files to be opened with php5 parser.
76595
I accidentally used  sudo chmod 3 /   which gives a execute and write permission to the root directory, while deleting the read permission. How can I recover from this, I cannot even use sudo now.
25307
Sorry for the basic question - I'm a .NET developer and don't have much experience with LAMP setups.  I have a PHP site that will allow uploads to a specific folder. I have been told that this folder needs to be owned by the webserver user for the upload process to work, so I created the folder and then set permissions as such:  chown apache:apache -R uploads/ chmod 755 -R uploads/   The only problem now is that the FTP user can not modify the uploaded files at all.  Is there a permission setting that will allow me to still upload files and then modify them later as a user other than the webserver user?
119526
We are having a little problem on a server. We want that some users should be able to do e.g. sudo and become root, but with the restriction that the user can't change root password. That is, a guarantee that we still can login to that server and become root no matter of what the other users will do.  Is that possible?
2188
Ok I just royally screwed up my /var folder's permissions.  I thought I was inside /var/www and did a chmod xxx ./* on the parent folder /var instead.  Now all the permissions inside /var are messed up. What can I do to correct it?
116031
I'm trying to write some PHP to upload a file to a folder on my webserver. Here's what I have:  &lt;?php     if ( !empty($_FILES['file']['tmp_name']) ) {         move_uploaded_file($_FILES['file']['tmp_name'], './' . $_FILES['file']['name']);         header('Location: http://www.mywebsite.com/dump/');         exit;     } ?&gt;  &lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"     "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"&gt; &lt;html&gt;     &lt;head&gt;         &lt;title&gt;Dump Upload&lt;/title&gt;     &lt;/head&gt;     &lt;body&gt;         &lt;h1&gt;Upload a File&lt;/h1&gt;         &lt;form action="upload.php" enctype="multipart/form-data" method="post"&gt;             &lt;input type="hidden" name="MAX_FILE_SIZE" value="1000000000" /&gt;             Select the File:&lt;br /&gt;&lt;input type="file" name="file" /&gt;&lt;br /&gt;             &lt;input type="submit" value="Upload" /&gt;         &lt;/form&gt;     &lt;/body&gt; &lt;/html&gt;   I'm getting these errors:     Warning: move_uploaded_file(./test.txt) [function.move-uploaded-file]: failed to open stream: Permission denied in E:\inetpub\vhosts\mywebsite.com\httpdocs\dump\upload.php on line 3      Warning: move_uploaded_file() [function.move-uploaded-file]: Unable to move 'C:\WINDOWS\Temp\phpA30E.tmp' to './test.txt' in E:\inetpub\vhosts\mywebsite.com\httpdocs\dump\upload.php on line 3      Warning: Cannot modify header information - headers already sent by (output started at E:\inetpub\vhosts\mywebsite.com\httpdocs\dump\upload.php:3) in E:\inetpub\vhosts\mywebsite.com\httpdocs\dump\upload.php on line 4   PHP version 4.4.7 Running IIS on a Windows box. This particular file/folder has 777 permissions.  Any ideas?
1363
sorry fresh user. I installed about 9 days ago and had issues with Unity disappearing which took 5 days of headaches to fix. It never did fix, I reinstalled.   I set up Plex (media server) and while the server is running and can be accessed by external network devices, I can't add files. Plex says this is because of permissions. I have gone up and down the forums here and at Plex to get an answer. It seems everyone says   chmod -R 755 /media/My\ Book/Videos   will change permissions to allow the folder "Videos" on my external USB 2.0 NTFS 3TB Western Digital drive (which is mounted and accessible through the file manager) as well as every sub-directory and file contained therein to be accessible to user "Plex".  I have used file manager and as soon as you click to change permissions it changes right back. When I chmod with -c it tells me every file is changed (usually 600) to 755 as I commanded it to do. I did   ls -l   to verify and there is no change. (I also used ls -l to make sure I knew who the owner was and it is me (mvl1014). ls -al gives me the same info.)  I swear to god I tried to sudo it and after smashing my head against this keyboard for basically the entirety of my day, I tried it as root. I was scared shi-less but couldn't come up with anything else. sudo su to root and then chmod -R -c /media/My\ Book/Videos  Same result. -c told me every single file was changed and a check in Unity or in terminal confirmed not a darn thing changed.  Now it seems to me that even if that isn't the thing stopping Plex from working there is still a problem with this command not going through.  12.04LTS -- on gen 1 i7 (2.7 GHz I believe) with 6 GB ram   I've attempted to attach a screenshot but I'm told I need 10 reps to do so, which means I'm copy/pasting too.  Please excuse my obfuscation, but Lorem Ipsum seemed unnecessary. And I tried multiple ways to format this but it looks perfect every way and messed up each time in the preview below. (Ugh, I'm a mess.)  $ chmod -R -c 755 /media/My\ Book/Videos  .....  .....  .....  mode of `/media/My Book/Videos/xxxx/xxxx/xxxx.mkv' changed from 0600 (rw-------) to 0755 (rwxr-xr-x)    ls -al shows:  mvl1014@FX6800:/media/My Book/Videos$ ls -al   total 88  drwx------ 1 mvl1014 mvl1014     0 Aug 28 15:17 .   drwx------ 1 mvl1014 mvl1014 20480 Sep  3 14:29 ..  drwx------ 1 mvl1014 mvl1014  8192 Aug 28 15:18 xxxx drwx------ 1 mvl1014 mvl1014 49152 Aug 16 14:02 xxxx drwx------ 1 mvl1014 mvl1014  8192 Aug 27 21:36 xxxx drwx------ 1 mvl1014 mvl1014  4096 Jul 23 19:09 xxxx   I apologize if this has been asked. I looked through this place plus at all the suggested "Similar Questions". The closet thing I got to an answer , but running the provided code with my own UID didn't work either.
19198
I was wondering if it was possible to reset all the folders' rights. I was having trouble when trying to install LAMP on my Ubuntu 11.04 installation, and I modified many permissions like /var /etc and I want to cancel everything I did and have permissions set to how they would be after a new install.
35211
I have an odd problem...I'm using a documentation generator which generates a lot of output like docs/foo.php.html. It's XHTML, and thus contains &lt;?xml...&gt; tags at the beginning of file. The problem is, Apache has somehow decided to run it through the PHP interpreter, even though ".php" appears in the middle of the filename, and not at the end. This, in turn, triggers a PHP error, because it sees "&lt;?" as the command to start executing PHP code, and immediately gets confused by the "xml..." which follows it.  How do I configure Apache to ONLY execute .php files and not .php.html files? The string "php.html" does not appear explicitly anywhere in my Apache config files. There is a line "AddHandler php5-script .php", but I don't see how that would also include ".php.html" files.