[cobalt-security] Re: Re: RE: SSI Vuln on cobalt

[Chris Adams <cmadams@xxxxxxxxxx>]

Once upon a time, Jeff Lasman <jblists@xxxxxxxxxxxxx> said:
> Chris Adams wrote:
> > And, as others and I mentioned, that doesn't work.  All the site admin
> > has to do is delete your root-created .htaccess file or create a
> > subdirectory.
> 
> What about Larry Smith's suggestion?

If that is the one about limiting uploads with proftpd, then that might
work if you block enough files (for example, I know he missed
.procmailrc - I don't know what else though).

The other thing about this is that by doing so, you've also denied your
sites normal capabilities such as password protecting part of their site
or anything else you can do from .htaccess.
-- 
Chris Adams <cmadams@xxxxxxxxxx>
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.