LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 05-07-2007, 08:47 AM   #1
lostjohnny
Member
 
Registered: May 2006
Distribution: Fedora Core 6
Posts: 37

Rep: Reputation: 15
"Out the box" security of Apache, PHP and MySQL on FC6


Hi,

A few months ago I was running a web database using PHP3, MySQL and Apache on Red Hat 9.0 which was hacked and used to host a phishing scam.

I've now installed FC6. Do the installations of Apache, MySQL and PHP5 as they come with the distribution offer adequate security or are there steps that everyone should take?

I'm aware of the basic security considerations of running PHP scripts, such as not keeping modules in the httpdocs directory and not allowing unfiltered input to be used in SQL statements.

Graham
 
Old 05-07-2007, 01:45 PM   #2
hob
Senior Member
 
Registered: Mar 2004
Location: Wales, UK
Distribution: Debian, Ubuntu
Posts: 1,075

Rep: Reputation: 45
FC6 incorporates SELinux as well as a firewall, so has fairly strong protection against remote exploits. The last time I looked at Fedora (FC5) the greatest weakness was that it enables SSH automatically, with remote root access permitted.

Once you turn that off, the biggest issue will probably be minimizing the access that local PHP scripts have into the database, which you've already mentioned.
 
Old 05-07-2007, 03:54 PM   #3
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,300
Blog Entries: 54

Rep: Reputation: 2855Reputation: 2855Reputation: 2855Reputation: 2855Reputation: 2855Reputation: 2855Reputation: 2855Reputation: 2855Reputation: 2855Reputation: 2855Reputation: 2855
A few months ago I was running a web database using PHP3, MySQL and Apache on Red Hat 9.0 which was hacked and used to host a phishing scam.
Not to kick you in the back but there's more than enough risks there to keep anyone busy... RHL 9 was deprecated a long time ago (and you couldn't have updated it with Fedora Legacy since they're gone), PHP3 is deprecated as well IIRC, but more likely the problem has been with the PHP-based apps you ran.


Could check out the LQ FAQ: Security references, post #6 "Securing networked services " for more on the "AMP" part of LAMP. Once you have those locked down you're ready to fight your PHP-based apps. Some developers even force people to run unsafe setting because else it won't work... Eventually it's your choice to either go with that investing in reinforcing the rest or try to find a "less unsafe" alternative. If you have a spare box it would be a good thing to mimic your setup there, secure it and throw some OWASP/Metasploit/Nessus tests at the box. In short: no, there's no out-of-the-box secure setup.
 
Old 05-09-2007, 04:15 AM   #4
lostjohnny
Member
 
Registered: May 2006
Distribution: Fedora Core 6
Posts: 37

Original Poster
Rep: Reputation: 15
Thanks guys.

hob, I'd noticed that I had root access using SSH as I've been using that on my LAN. I'll disallow root as a user. Otherwise I find your reply re-assuring.

unSpawn, in a way I'm glad to know that the platform I was running was so insecure - it offers an explanation as to why I was hacked that means it should be less likely now I've upgraded. It does make me look rather lapse putting such a server on the Internet, but at the time I thought the worst thing a hacker could do was steal your data and I was only running a test site - there was no real data on the server.

Thanks for the link to the post relating to AMP. I see there are even some checking tools referenced there.

When I write PHP scripts I try to write code that ideally work whatever the configuration or at least with the most common/default/secure configuration. It's a culture shock to me how much the environment affects the running of the scripts as I'm mostly a C programmer, used to a program doing what you program it to do.

Thanks again,

Graham
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Lost "Shutdown" and "Restart" From system menu in FC6 Nader1 Linux - Software 3 02-12-2007 04:40 PM
apache security for intranet: "listen 80" vs. "listen 127.0.0.1:80" pulper Linux - Software 3 09-27-2006 06:24 AM
MySQL/PHP/Horde "Failed to write session data" Big Money Linux - Software 0 11-23-2004 01:33 PM
Php or Mysql upgrade on Fedora Core 2 "Uptodate" Program geninblaze Fedora 1 07-12-2004 09:56 PM
PHP "for.. loop" to insert into mysql Boby Programming 10 05-29-2004 10:07 AM


All times are GMT -5. The time now is 09:41 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration