SSH public_html vuln

[Joe]

joe@darkside:/home/zorm/public_html$ ls
__ZORMS_FILES_HERE__

I really don't think thats supposed to be allowed.

The problem here is I can open his config.php file and get his database file. I'm too mature to use it (er, ok, I don't know how to use it), but in the wrong hands, this is bad.

[Ergot]

chmod 706 ?

[Krazed]

That's it in the httpd.conf file.

iago, get to work. I'll do it if you want.

[iago]

That's not a vuln, it's because the public_html has world-read permissions (0755).  There are 3 options to fix that:
1. Make the folder 0711.  Executable but not readable.
1. Make public html owned by the group "nobody", and assign the permission 0750
2. Make Apache SEXEC (I think), so that Zorm's stuff runs as the user Zorm, and make the permission 0700.  But that opens a whole new barrel of monkeys. 

Also, that's not "SSH" at all, even if it was a vuln it would be a permissions vuln.  SSH is the means to get a remote connection and has nothing to do with what happens once you're there. 

[Joe]

Either way, I can get his PHP source code. =p

[iago]

And if I get complaints about how you act on my server, I'll cut off your access. 

[deadly7]

And if I get complaints about how you act on my server, I'll cut off your access.

*coughs* iago forgot AIM already?

[iago]

And if I get complaints about how you act on my server, I'll cut off your access.

*coughs* iago forgot AIM already?

That's not what I meant.  He can store whatever he wants there, provided it's legal, information should be free.  I meant abusing it.