[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[cobalt-security] RE: SSI Vuln on cobalt
- Subject: [cobalt-security] RE: SSI Vuln on cobalt
- From: Barbara <thebizworkers@xxxxxxxxx>
- Date: Sun, 21 Apr 2002 22:06:41 -0700 (PDT)
- List-id: Mailing list for users to address network security on Cobalt products. <cobalt-security.list.cobalt.com>
>Thats quite a nice way of doing it, but that
>still doesnt stop users from uploading
>htaccess.txt and then renaming it on the server
>using there FTP client.
>>What I *do* use to stop those files from being
>>uploaded in the first place, is this little line
>>in my proftpd.conf file..
>>
>>PathDenyFilter
>>"(\\.ftpaccess)|(\\.htaccess)|(\\.forward)$"
Very good point, that's something I didn't even
consider.
But there is another directive in ProFTP which can
control the commands end users can send/execute, the
"AllowFilter" directive.
Orginally I didn't include this directive in my ftp
config, but I think I'll drop it in as;
# Only allow commands containing alphanumeric
characters and whitespace
AllowFilter "^[a-zA-Z0-9 ,]*$"
as suggested on this page;
http://proftpd.linux.co.uk/docs/directives/linked/config_ref_AllowFilter.html
And that should stop someone from renaming files to
one with a "." in the file name.. (but I haven't tried
this yet)..
Babs
__________________________________________________
Do You Yahoo!?
Yahoo! Games - play chess, backgammon, pool and more
http://games.yahoo.com/