Tag Info

Hot answers tagged

7

If you can avoid it, you should not be running the web server processes as the root user, since that means the compromise of any vulnerability in the web service will completely compromise the server. With where you are now, I'd recommend starting from scratch on a new server - the attacker could have given themselves persistent root access through any ...


4

Anything under /root is usually owned by the root user. PHP does usually not (and for security reasons should never) run under the root user. You should install the gsutil in a location where PHP has execute rights. For example, copy it to /var/www: cp /root/gsutil/gsutil /var/www/gsutil I think that under Ubuntu PHP usually runs as the www-data user (not ...


4

Create a user account (or add an existing user account) and add it to the Backup Operators group and run your task as that user.


3

Move your pictures out of /usr/lib//cgi-bin/ folder and put them somewhere within /var/www/ Update your paths accordingly. Every time you trying to access any file within cgi-bin path it is expecting that content will be generated by executing that file.


3

The reasoning for this question is questionable ... To critique your desired solution of creating a new user -- even if other root users can't change new-user's password they don't need to since root can read any file or change the file permissions of the file -- they don't ever need to "be" that user." I you have terabytes of data you want to prevent ...


2

You simply use a tool that preserves the permissions and owners when you copy the files. The classic tar stores owners and permissions in the archive itself and using the -p or --preserve-permissions will preserve and/or restore them when you extract files from that backup archive. Other tools also preserve owner and permission information, either by ...


2

Ultimately if you give someone root access to your system, you give them everything on the system, that's why it is important for you to trust people you give root to.


1

This sounds like a UAC issue. See if you can access the folder(s) with an elevated command line (like PowerShell), rather than Windows Explorer. The issue is that Windows Explorer does not behave "properly" with UAC, so problems like this often result. The linked article has a couple of workarounds, though personally, I prefer to just use a different ...


1

I suppose you could set an immutable extended filesystem attribute on /etc/shadow. That will prevent all changes to passwords, until the root user undoes the immutable bit. The command is "chattr +i /etc/shadow" If you are provisioning root access to a professional sysadmin you're supposed to assume that they won't change the password if you ask them not to ...


1

In spite of all these changes, another user is always able to change files, rename folders, and upload another hacked file. If the parent directory of your web root is owned by the same user who runs the web server, then those parent directory permissions would override any permissions set to child files and directories. For example, open up a ...


1

Temporarily mount the filesystem as RW, fix the permissions and the mount it RO again.


1

i would recommend you to use acls here: setfacl -R -m user:apache:rwx directory setfacl -R -d -m user:apache:rwx directory setfacl -R -m user:developer:rwx directory setfacl -R -d -m user:developer:rwx directory


1

I has been ages that I am not doing anything in PHP but, without further info there would be a couple system configuration elements and php.ini settings I would check: path to the log file Please, ensure that the user running apache is able to reach the directory where the file is. That means it should have r+x access to the directories along the path. ...


1

Well, you should tell us about your goal AND attempted solution. Without goal, we can't give you alternative solution. Looking from the comment, looks like you want to whitelist some client to relay via your server. Postfix itself has ACL-relay mechanism via smtpd_*_restriction. To know what enabled ACL in postfix, you can run command postconf | grep ...


1

You can use PowerShell without needing to download anything else. This will work with v2.0 and later: $ReferenceAccountName = 'DOMAIN\Username' [string[]]$SearchDirectories = @('X:\SomeDirectory', 'F:\AnotherDirectory') foreach ($RootDir in $SearchDirectories) { $DirACL = Get-Acl -Path $RootDir foreach ($ACL in $DirACL.Access){ if ...


1

You cannot set "modify" to a folder for a user without having "execute" permission on it for that user... and, as suggested by another answers here, it's not even possible do deny execution preserving modify so the solution may be this: a Group Policy for Disallowing Execution by default then whitelisting may be the choiche: Computer Configuration > ...



Only top voted, non community-wiki answers of a minimum length are eligible