Joomla! Discussion Forums



It is currently Mon Nov 23, 2009 9:07 pm (All times are UTC )

 


Forum rules

Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Security Checklist
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.



Post new topic Reply to topic  [ 235 posts ]  Go to page Previous  1 ... 4, 5, 6, 7, 8
Author Message
Posted: Sun Feb 11, 2007 3:11 am 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Mon Dec 25, 2006 9:42 pm
Posts: 111
Location: United States
@Darren

Sorry for the late reply...work as me in South America and the connection is pretty unreliable.  Anyway, those look like script kiddie attacks to me.  They are old, basic attacks.  I wouldn't worry to much about it.  However, you could filter your access logs based on some of the attacking IP address to see exactly what they are doing.  ;)

As far as filtering based on user agents, it would work, but I would be careful.  The last thing you want is legitimate visitors getting a lovely 403 error.  As far as .htaccess modification, you could remove write privileges from the Apache daemon so if someone compromises the account they still can't do much.  Another thing you could do is make the owner of all files a different account except for those that your users need to modify, if that applies, such as the images directory...or just make it 777, I don't like world write though.  This would mitigate the threat as well, if someone gets in far enough to compromise the Apache daemon, they still can't do much. 


@SoftDux

RewriteRule ^(.*)$ index.php [R=403,L], I haven't tested it much...I use lighttpd ;), but...from what I understand, R is for redirect and this line was supposed to redirect to a 403, forbidden page.  However,

RewriteRule ^(.*)$ index.php [F,L]

is functionally the same, it too will redirect to a 403 forbidden page.  In Apache, in syntactical errors in .htaccess files will cause a 500 message.  It could be that infograf768's server configuration didn't support R=403.

Hope that helps.  8)

Jeff McCoy


Top
  E-mail  
 
Posted: Sun Mar 11, 2007 12:36 am 
User avatar
Joomla! Intern
Joomla! Intern
Offline

Joined: Wed Jul 26, 2006 8:13 pm
Posts: 52
Location: Spain
godaddy servers, this is my htaccess file

##
# @version $Id: htaccess.txt 5973 2006-12-11 01:26:33Z robs $
# @package Joomla
# @copyright Copyright (C) 2005 Open Source Matters. All rights reserved.
# @license http://www.gnu.org/copyleft/gpl.html GNU/GPL
# Joomla! is Free Software
##


#####################################################
#  READ THIS COMPLETELY IF YOU CHOOSE TO USE THIS FILE
#
# The line just below this section: 'Options +FollowSymLinks' may cause problems
# with some server configurations.  It is required for use of mod_rewrite, but may already
# be set by your server administrator in a way that dissallows changing it in
# your .htaccess file.  If using it causes your server to error out, comment it out (add # to
# beginning of line), reload your site in your browser and test your sef url's.  If they work,
# it has been set by your server administrator and you do not need it set here.
#
# Only use one of the two SEF sections that follow.  Lines that can be uncommented
# (and thus used) have only one #.  Lines with two #'s should not be uncommented
# In the section that you don't use, all lines should start with #
#
# For Standard SEF, use the standard SEF section.  You can comment out
# all of the RewriteCond lines and reduce your server's load if you
# don't have directories in your root named 'component' or 'content'
#
# If you are using a 3rd Party SEF or the Core SEF solution
# uncomment all of the lines in the '3rd Party or Core SEF' section
#
#####################################################

#####  SOLVING PROBLEMS WITH COMPONENT URL's that don't work #####
# SPECIAL NOTE FOR SMF USERS WHEN SMF IS INTEGRATED AND BRIDGED
# OR ANY SITUATION WHERE A COMPONENT's URL's AREN't WORKING
#
# In both the 'Standard SEF', and '3rd Party or Core SEF' sections the line:
# RewriteCond %{REQUEST_URI} ^(/component/option,com) [NC,OR] ##optional - see notes##
# May need to be uncommented.  If you are running your Joomla!/Mambo from
# a subdirectory the name of the subdirectory will need to be inserted into this
# line.  For example, if your Joomla!/Mambo is in a subdirectory called '/test/',
# change this:
# RewriteCond %{REQUEST_URI} ^(/component/option,com) [NC,OR] ##optional - see notes##
# to this:
# RewriteCond %{REQUEST_URI} ^(/test/component/option,com) [NC,OR] ##optional - see notes##
#
#####################################################


##  Can be commented out if causes errors, see notes above.
Options +FollowSymLinks

#
#  mod_rewrite in use

RewriteEngine On


#  Uncomment following line if your webserver's URL
#  is not directly related to physical file paths.
#  Update Your Joomla!/MamboDirectory (just / for root)

# RewriteBase /nvd


########## Begin - Joomla! core SEF Section
############# Use this section if using ONLY Joomla! core SEF
## ALL (RewriteCond) lines in this section are only required if you actually
## have directories named 'content' or 'component' on your server
## If you do not have directories with these names, comment them out.
#
#RewriteCond %{REQUEST_FILENAME} !-f
#RewriteCond %{REQUEST_FILENAME} !-d
#RewriteCond %{REQUEST_URI} ^(/component/option,com) [NC,OR] ##optional - see notes##
#RewriteCond %{REQUEST_URI} (/|\.htm|\.php|\.html|/[^.]*)$  [NC]
#RewriteRule ^(content/|component/) index.php
#
########## End - Joomla! core SEF Section



########## Begin - 3rd Party SEF Section
############# Use this section if you are using a 3rd party (Non Joomla! core) SEF extension - e.g. OpenSEF, 404_SEF, 404SEFx, SEF Advance, etc
#
RewriteCond %{REQUEST_URI} ^(/component/option,com) [NC,OR] ##optional - see notes##
RewriteCond %{REQUEST_URI} (/|\.htm|\.php|\.html|/[^.]*)$  [NC]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule (.*) index.php
#
########## End - 3rd Party SEF Section



########## Begin - Rewrite rules to block out some common exploits
## If you experience problems on your site block out the operations listed below
## This attempts to block the most common type of exploit `attempts` to Joomla!
#
# Block out any script trying to set a mosConfig value through the URL
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
# Block out any script trying to base64_encode crap to send via URL
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
# Block out any script that includes a


Who is online

Users browsing this forum: No registered users and 17 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group