Reputation
799
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
9 22
Impact
~260k people reached

May
13
revised LAMP stack security question - uploading files to server
added 42 characters in body
May
13
comment LAMP stack security question - uploading files to server
@morpheous, this page includes some info about setting up key based auth over SSH: troy.jdmz.net/rsync/index.html Given that both computers are Linux-based then it'll make it a bit easier. As for preserving permissions, you'll be fine. The -a part preserves those. It won't preserve owners/groups, which you probably don't want when going between servers unless it's a backup, in which case look into --fake-super option under rsync's documentation, but that is kinda complicated and requires xattrs on the destination filesystem.
May
12
revised security issue of Linux sudo command?
added 110 characters in body
May
12
answered security issue of Linux sudo command?
May
12
answered LAMP stack security question - uploading files to server
May
12
revised LAMP stack security question - uploading files to server
added 186 characters in body; added 11 characters in body
May
12
answered LAMP stack security question - uploading files to server
May
12
revised I just got a linode VPS a week ago and I've been flagged for SSH scanning
added 70 characters in body
May
12
answered I just got a linode VPS a week ago and I've been flagged for SSH scanning
May
12
accepted Security issues of running PHP scripts as the owner of the PHP file with suexec
May
11
comment Security issues of running PHP scripts as the owner of the PHP file with suexec
What about using suexec to run scripts with some unprivileged username, and the group name of the user? For example running scripts as <www-data2>:<username> where www-data2 has basically no write permissions anyway, and a user can make a file writable by setting group write on. Then the scripts can't write to themselves, but can't write to other users' writable files either. I'm guessing, however, that given that people don't seem to do this, there must be a reason against it...
May
11
revised Security issues of running PHP scripts as the owner of the PHP file with suexec
edited title
May
11
comment when should I use “apache:apache” or “nobody:nobody” on my web server files?
Reason for having Apache run as a user other than "nobody" is that if someone compromises Apache (through a bad PHP script, for instance) they are stuck in a user account that's only used for Apache and nothing else. Other services use the "nobody" account.
May
10
awarded  Citizen Patrol
May
10
comment Best Linux flavor for web application development (LAMP)
I'm a Debian person myself, but I would also include Ubuntu LTS in that list of stable distros. Each release has security support for at least 5 years.
May
10
comment Best Linux flavor for web application development (LAMP)
I've read that Ubuntu and Debian installations far outnumber other distros on virtual private servers at linode.com and slicehost, for example. Not that CentOS isn't popular elsewhere...
May
10
awarded  Editor
May
10
revised Security issues of running PHP scripts as the owner of the PHP file with suexec
added 2 characters in body
May
10
answered Solution for when your website's emails goes into yahoo or gmail spam folder
May
10
comment Choosing a Wiki for an academic institute
I work at a university that uses Confluence...