1
hrac
hacked sites and file permissions
  • 2009/4/26 8:44

  • hrac

  • Quite a regular

  • Posts: 305

  • Since: 2002/7/15


Hello,

Last week, my several websites attacked and hacked (hacker overwrites his file over original index.php file of xoops) easily :(

I opened a case to my hosting provider, and they said your all files have wrong file permission: 755 file permission (rwxr-xr-x) and they should be 644 (rwxr--r--) except directories of course. But nearly all XOOPS files comes from tar packages have 755 permissions.

Do you think do we need to remove executable permissions from ordinary files and does this make our websites safer?

My websites hacked by overwriting index.php file. If I change index.php's permission to 444 (r--r--r--), does this mean my website is safer?

Thanks

2
jdseymour
Re: hacked sites and file permissions

644 which is -rw-r--r-- is the correct permissions for files. Only the owner of the files have write permissions, and the owner should be the user that the server runs as (usually apache). If the server itself runs suphp then the owner should be the owner of the home directory the files reside.

755 is definately not right for file level permissions (however still does not allow write for group or others). I think I reported this at one time as another forum post.

mainfile.php should be 444.

3
hrac
Re: hacked sites and file permissions
  • 2009/4/26 16:52

  • hrac

  • Quite a regular

  • Posts: 305

  • Since: 2002/7/15


So is it better to publish installation packages with 644 permissions instead of 755?

4
ghia
Re: hacked sites and file permissions
  • 2009/4/29 0:30

  • ghia

  • Community Support Member

  • Posts: 4953

  • Since: 2008/7/3 1


Yes.

Login

Who's Online

222 user(s) are online (143 user(s) are browsing Support Forums)


Members: 0


Guests: 222


more...

Donat-O-Meter

Stats
Goal: $100.00
Due Date: Mar 31
Gross Amount: $0.00
Net Balance: $0.00
Left to go: $100.00
Make donations with PayPal!

Latest GitHub Commits