Securing writeable (CHMOD 777) folders

[gvard]

Greetings from Greece,

I just received a note from zone-h.org that my eSupport installation was hacked. To be more exact, someone placed an index.php in the /files directory of eSupport.

The above directory (and cache directory) are CHMOD'ed 777, is there any way to prevent something like this from happening?

[supportskins]

This is something new! I suggest you edit the post and remove the "way" your helpdesk was hacked and contact Kayako Support for more feedback.

[bear]

He didn't include the way, he included the result.
Common knowledge about directory permissions in Kayako, I should think.

[gvard]

Yes, I just included the result. Unfortunately those directories need to be in 777. What do you guys use to secure them from remote scripts?

[Sheep]

why is the /files/ used... are you using flat storage instead of database storage?
If yes, that's where you can see the difference in security issues. Database files aren't real files.

[craigbrass]

It would seem more likely that they have got in through a 3rd party piece of software but contact Kayako and post your ticket ID here so it can be chased ASAP.

[gvard]

Originally Posted by Sheep

why is the /files/ used... are you using flat storage instead of database storage?
If yes, that's where you can see the difference in security issues. Database files aren't real files.

I'm using database storage, so that's not the issue. I believe the directory gets created one way or another.

[gvard]

Originally Posted by craigbrass

It would seem more likely that they have got in through a 3rd party piece of software but contact Kayako and post your ticket ID here so it can be chased ASAP.

They got through another application from another hosting account. I don't say that esupport has any security issues, I'm just asking how do you protect 777 directories from nobody owned files which can be uploaded through a remote script?

[Sheep]

On such folders: Chmod should always be 660, if 770 is needed then do it but **1 should never be.
Chown should be set to an "apache" account, that way you could get a chmod 600. That's more secure

[Mohit Sharma]

Hi,

It is not much of a security problem. Chmod 777 only gives read/write/execute access to other users on the system. Depending on apache configuration, you're probably going to be running as the "nobody" user. If a script is exploited, then that exploit is being carried out by the nobody user.And without privileged access to the system a simple user cannot do any harm to the system . If he gets privileged access it means there is some vulnerability in the operating system. While it is a good idea to chmod from 777 to 776, to prevent nobody from even executing the files. Like in SupportSuite we do not require execute permissions with "Files" and "Cache" directory.

Systems that run phpsuexec instead of mod_php then scripts aren't being executed by nobody. They are executed by the website's account on the server. So, chmod 777 won't change anything.

Regards,

[DarkMindZ]

http://www.darkmindz.com/forum/prote...folders-num481