Forum Post Assistant / FPA Discussion

[bmareal]

I'm trying to run de FPA on my site, but i can't get any results.

Turning on the diagnostic-mode is giving me the following message:
PHP Warning: readdir() expects parameter 1 to be resource, boolean given in /home/*****/public_html/fpa-en.php on line 1476

the script is in the same directory where joomla is installed, and all the folders seem to have the right permissions...

Any ideias?

[PhilD]

It is unable to read one or more directories. Do you have any set to less than 755? Perhaps your host set some malware directories to something like 000 or a hack set some odd permissions on directories?

[bmareal]

It is unable to read one or more directories. Do you have any set to less than 755? Perhaps your host set some malware directories to something like 000 or a hack set some odd permissions on directories?

yeah... i want to run the fpa exactly because i need to figure out if i was hacked, so the odd permissions are always a possibility. I can't see any folders with permissions below 755 though, and everywhere i looked seemed right... but i'm looking only to the folders using the cpanel file manager.

Any suggestion of a way to check the folder/subfolder permissions? I would like to check if something is wrong before starting to make changes to files and folders...

[leolam]

As Phil asked also: Is your public_html folder set to '750' or '000' (means locked)

In general just install Admin Tools and have Admin Tools set for you all permissions automatically to 755 and 644 ina your entire site

Leo

[bmareal]

Oh, i didn't got that... sorry!

My public_html file is set to '750'. I figured out that i had another random (non-jomla) folder set to '000' from a previously failed upload or something.

I'm able to run JPA now, tanx for the hints!

I can't figure out anything wrong in the report, but i should create a different post for that, right?

[PhilD]

Yes, create a post in the appropriate forum so we can help.

[Heart]

General question... I was hacked and had a few trojans in the /tmp folder. So I used fpa (and other check scripts) to find illegal files in my joomla root and subfolders.

What I have now are the following new mysql databases named "bf_core_hashes, bf_files, bf_folders,
bf_folders_to_scan und bf_scan_state" and I don't know if these came from fpa, or from the myjoomla.com a udit, or is this from the trojan I had, or or or ....!?

[PhilTaylor-Prazgod]

Tables prefixed with bf_ (and not your db prefix like jos_bf_*) are created by the myJoomla.com web service and be safely deleted at any time. They will be regenerated each time you run an audit using the security service at myJoomla.com

If you have any further questions about the service of myJoomla.com please contact me directly using the contact form on the website. I do not monitor this forum :-)

Kindest regards
Phil.

[PhilD]

Thanks Phil for explaining the tables existence.

[the_observer]

where can i download FPA ?

The links existing are just downloading a *zip file which is empty.

Thank you for your time reading this.

Regards,
the_observer.

[leolam]

The links existing are just downloading a *zip file which is empty.

I confirm this and I have contacted the moderators on this

Leo

[PhilD]

The links are correct, but I think there is currently an issue with the zipball service of github.

[leolam]

Thanks Phil for the prompt reply!

Leo

[PhilD]

As a temporary measure while I sort the GitHub issues, I have uploaded a zip version of the FPA file and docs to the Forum Post Assistant / FPA topic in the 2.5 security forum.
http://forum.joomla.org/viewtopic.php?f=621&t=582860

File that is attached is named FPA-en-GB.zip

[PhilD]

Update.
The normally reliable GitHub had some issues yesterday that affected some repositories. The FPA repository was one of those affected.

The links to the FPA Github download have been restored to the Forum Post Assistant / FPA topic in the 2.5 security forum. http://forum.joomla.org/viewtopic.php?f=621&t=582860

[webolution]

I am attempting to run FPS for the first time on one of my sites and have run into the following error and I am not sure how to handle it and Google has been no help...

Array ( [0] => apache_child_terminate [1] => apache_request_headers [2] => apache_response_headers [3] => getallheaders )

Thanks for any assistance.

[R3yisgood]

hi

i tried to run fpa from my browser and this the results

Parse error: syntax error, unexpected $end in /home/k4724275/public_html/fpa-en.php on line 5609

whats wrong?

[gk_theodore]

Dear All,

In my WIMP (Windows/IIS/MySQL/PHP) stack, FPA always reports folder permissions as 777.
No matter what I do: Take ownership, make me the sole owner, give no one permissions but myself and even that, give myself only Read permission it still says: 777.

Can somebody confirm / replicate this?

Thank you,
---
Theodore.

[Per Yngve Berg]

The Windows File System does not have an access permission based on owner. Therefore it always shows 3 equal numbers.

[gk_theodore]

The Windows File System does not have an access permission based on owner. Therefore it always shows 3 equal numbers.

Thank you for your reply.
Why then the numbers are 7 (Full Control) even if I only give Read-Only perms to the owner?

[PhilD]

See this doc page for an explanation of windows file permissions and how to relate them to unix file permissions.

Most local development servers and the computers they run on are not intended or set up properly for permissions/ownerships and should not be used for live hosting.

The FPA reports the effective permissions that are seen by the php process run by the web server. So if it (FPA) reports 777 then that is the effective permissions seen by the web server installed on the computer. It can be a pain to properly setup the ownerships and permissions under standard windows installs and pass those permissions to the webserver properly.

[gk_theodore]

See this doc page for an explanation of windows file permissions and how to relate them to unix file permissions.
...

There is no link but I believe you mean the following:
http://docs.joomla.org/How_do_Windows_f ... ns_work%3F

So, you're saying that you (or somebody else) have tried FPA in an NTFS environment and found it to properly report permissions?
(Other than 777 obviously)

[PhilD]

Yea that's the one, sorry I forgot the link.....

[PhilD]

I'm not going to claim to be any expert on permissions and acl settings in windows.

I believe the original author of the FPA did testing on Unix and IIs boxes and I believe the methods used are proven correct in those environments.

The FPA is written in php and uses a standard php calls for determining the effective permission levels, and ownerships, and reports the permissions as they are reported to the php process.

Running a *amp (xamp, wamp, etc) install under windows is vastly different than running an actual IIs server. *amp installs are not by default secure, nor are intended to be secure out of the box and are generally intended to be a development environment for testing. When running a *amp install, the ports of the apache server, mysql server, cgi, and php etc. are running on top of the windows install. Most windows do not have the correct settings for server use and the install will inherit the permissions, groups, etc. of the current user which are normally incorrect.

[gk_theodore]

...
I believe the original author of the FPA did testing on Unix and IIs boxes and I believe the methods used are proven correct in those environments.
...

I believe it so, but as I am sure you undertand, beliefs and hopes don't have any substance in this context do they?

...
Running a *amp (xamp, wamp, etc) install under windows is vastly different than running an actual IIs server. *amp installs are not by default secure, nor are intended to be secure out of the box and are generally intended to be a development environment for testing.
...

I never ran an *amp install and never said I did. I said I am running a WIMP STACK!
That is:
On a running Windows Server 2003 machine I installed IIS6 as per MS directions.
After that I installed MySQL.
After that I installed PHP, taking every care to install it properly and securely.

I'm not going to claim to be any expert on permissions and acl settings in windows.
...

I never claimed papal infallibility either! I could very well be mistaken!
But somebody PROVE me wrong and I will happily shout: "Mea culpa!"

[webmuse]

Found a minor bug in the code.

When pulling values out of the configuration.php file, it ignores if a value is inside a comment. I have one file that I can update for use locally or on the production server, so I have commented out a line that reads:

Code: Select all

// public $host = 'localhost';

This line was immediately before the line used by the system.

For this reason, I wasn't getting any of the database info, since my hosting provider uses a db running at a different url.
Once I changed the order of these lines, then fpa picked up the correct value.

It should be easy to have preg_match detect a line starting with '//', but it might require removal of all /* ... */ comments before extracting information.

Hope this might help others who want to see info that is not coming thru.

WebMuse

[PhilD]

I'll add it to the list of suggestions

[rygel]

I am attempting to run FPS for the first time on one of my sites and have run into the following error and I am not sure how to handle it and Google has been no help...

Array ( [0] => apache_child_terminate [1] => apache_request_headers [2] => apache_response_headers [3] => getallheaders )

Thanks for any assistance.

I have the same problem. Is there any solution?

[Ir1sh]

One of the sites I just inherited has definitely been compromised. I have downloaded the fpa tool and have been trying to run it.

Unfortunately rackspace has its cloud sites set to timeout after 30 seconds which dosnt seem to be long enough for the tool to run and return the results. I have tried to change the max execution time in the script itself but it turns out that no matter what I do with the php rackspaces load balancers are set to time out after 30 seconds. I can run this script as a cron job but I dont think I can see the output then.

Can anyone tell me how to modify the script so that it exports the results to a new file in the same dir as the script? that way I can visit that page and view the results after the script has run.

[ayubjon]

As of today those links tothe Github is not working. Is there any other place from where I can download the FPA?