Discussion for: Using .htaccess files to block exploit attempts

Miraenda · **Joined:** Fri Jul 21, 2006 5:56 am **Posts:** 3

This entire thread is a great help for both protecting against security threats for Joomla as well as your post josoroma in helping to spot attacks easily. Thanks to everyone who had provided input, especially to RobS

random · **Joined:** Sat Sep 24, 2005 5:47 pm **Posts:** 221

Deleted by myself as I got the .htaccess file working from here.

Thanks for all your time writing this and it should keep the hackers out.

RobS · **Posted:** Sat Jul 22, 2006 4:14 pm

Thanks for the kind words

@random,

What turned out to be the problem if you don't mind me asking? You mentioned in the other thread that you were encountering a 403 error, did you find out why?

random · **Joined:** Sat Sep 24, 2005 5:47 pm **Posts:** 221

Yeah I was trying to use it as a stand alone .htaccess, when I copied and pasted your code below what I had, it then worked.

Man I spent a lot of hours yesterday messing around with my Joomla app but it is perfect now,

Again thanks for the .htaccess code, BTW my server blocks me turning my globals off. This should not be a problem now?

random · **Joined:** Sat Sep 24, 2005 5:47 pm **Posts:** 221

cross posting so deleted by myself.

RobS · **Posted:** Sat Jul 22, 2006 5:29 pm

random wrote:

Yeah I was trying to use it as a stand alone .htaccess, when I copied and pasted your code below what I had, it then worked.

Man I spent a lot of hours yesterday messing around with my Joomla app but it is perfect now,

Again thanks for the .htaccess code, BTW my server blocks me turning my globals off. This should not be a problem now?

Ah yes, you need the default htaccess file because that first enables the rewrite engine, etc. which the rules I suggested depend on.

It isn't accurate to say that register globals are no longer a problem while using those rewrite rules. I would say however that those rewrite rules are capable of blocking a large percentage of known attacks that depend on register globals. The operative phrase being "known attacks". But, such is the problem with any reactive defense mechanism. It is very hard to write rules to block attacks that don't exist yet. Do you know what I mean? On a more positive note, I have found them to be useful as they did block, for example, the recent OpenSEF issue when I first tried to test the bug on my system. Fortunately that hasn't made its way to an exploit because we were able to get in touch with the developers and get the issue resolved quickly. But if it had, those using that ruleset wouldn't have lost much sleep.

random · **Joined:** Sat Sep 24, 2005 5:47 pm **Posts:** 221

RobS wrote:

But if it had, those using that ruleset wouldn't have lost much sleep.

As I sit here with my eyes half wide open. I think I can deal with the lesser of two evils, I have heard that if globals are turned off it can add problems.

I can just add a php.ini to my server to overwrite but I am comfortable with how my host sees fit to have it set up.

Here is what they sent

We run phpsuexec on our server and it doesn't allow using of 'php_admin_flag' and 'php_admin_value' in .htaccess files.

If you want to modify php configuration for your site please upload php.ini to your home directory and set the variables inside of it.

RobS · **Posted:** Sat Jul 22, 2006 5:59 pm

Ah yes, phpsuexec can only be used via the CGI interface and you cannot override PHP config variables with an .htaccess file if you are using the CGI interface. Adding a php.ini file to your directory might be a good idea as register globals is rather unnecessary now-a-days and in fact is being removed from PHP... eventually.

Oh how I miss Apache perchild but I shouldn't get started on that.

random · **Joined:** Sat Sep 24, 2005 5:47 pm **Posts:** 221

RobS wrote:

Adding a php.ini file to your directory might be a good idea as register globals is rather unnecessary now-a-days and in fact is being removed from PHP... eventually.

Robs,

I have uploaded the php.ini file to my server, it does not switch the globals off though, I put it in the root and also in public_html.

I am guessing that I may need to remove your .htaccess code to switch globals off and then add back your code....?

TIA

RobS · **Posted:** Sat Jul 22, 2006 6:33 pm

My .htaccess code should have nothing to do with that. What are the contents of your php.ini file? (If it is really long do not paste it here, put it on a site like pastebin.com and then put the link here.)

random · **Joined:** Sat Sep 24, 2005 5:47 pm **Posts:** 221

http://rafb.net/paste/results/Jh458l73.html

mosmedia · **Joined:** Fri Aug 19, 2005 2:41 am **Posts:** 11

Hello All,

I have a questiona bout applying the rewrite rules on my server. I was told that it was better to put my htaccess rules in the apache conf file for each individual site since it is not loaded each time the site is accessed. Also I find this easier for me to do organizational wise. I am not an apache guru:) My joomla site is accessed through an alias ie: http://mysite.com/somedirectory actually pulls from a different folder than the mysite.com root folder. If in my conf file I put the directives like below will it only affect the aiased directory? The way apache is setup is to have one conf for the whole server and individual conf files for each site.

Also is there a way to test that the directives are working? Like a malformed URL to try?

RewriteEngine On
RewriteBase /intranet2

########## Begin - Joomla! core SEF Section
############# Use this section if using ONLY Joomla! core SEF
## ALL (RewriteCond) lines in this section are only required if you actually
## have directories named 'content' or 'component' on your server
## If you do not have directories with these names, comment them out.
#
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
#RewriteCond %{REQUEST_URI} ^(/component/option,com) [NC,OR] ##optional - see notes##
RewriteCond %{REQUEST_URI} (/|\.htm|\.php|\.html|/[^.]*)$ [NC]
RewriteRule ^(content/|component/) index.php
#
########## End - Joomla! core SEF Section

########## Begin - Rewrite rules to block out some common exploits
#
# Block out any script trying to set a mosConfig value through the URL
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
# Block out any script trying to base64_encode crap to send via URL
RewriteCond %{QUERY_STRING} base64_encode.*$.*$ [OR]
# Block out any script that includes a

Board index » Joomla! Older Version Support » Joomla! 1.0 » Security - 1.0.x

Who is online

Users browsing this forum: egrys and 19 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:

Joomla! Discussion Forums

Forum rules

Discussion for: Using .htaccess files to block exploit attempts

Who is online