Community Forums
Connect with us on LinkedIn
Community Notice
+ Reply to Thread
Page 4 of 19 FirstFirst ... 2 3 4 5 6 14 ... LastLast
Results 46 to 60 of 279
  1. #46
    Member serversphere's Avatar
    Join Date
    Jan 2004
    Posts
    658

    Default

    Nick, can you give us version information for what is patched? I ran an update earlier on Current machines and now see there is another version listed (12 on there now, 13 new version). Do I need to get to 13 to be safe? And how about other trees? Thanks.

  2. #47
    cPanel Partner NOC cPanel Partner NOC Badge DWHS.net's Avatar
    Join Date
    Jul 2002
    Location
    LA, Costa RIca
    Posts
    1,342

    Default

    Quote Originally Posted by cpanelnick
    We will be issuing a full security advisory on monday. In the mean time, updating is the primary focus.

    Kind of off topic but I sure would like a script that would update all the servers with one click. I mean logging into hundreds of servers and waiting for upcp takes the extra time that could save a server from being hacked.

  3. #48
    Member
    Join Date
    Aug 2002
    Posts
    1,118

    Default

    I have no problems with not knowing what the security issue is/was. I completely understand that with security issues you have to keep them private until you can be assured that it is patched or atleast the public that uses the product has been informed and had the chance to patch the system. I'm also assuming that the cPanel developers are checking other bits of the code that may be vulnerable to similar exploits and patching those as well.

    I was just asking for clarity as to whether or not upcp fixes this for all builds, since my release build does not appear to increment when I update. However, techark has informed me that this does indeed fix this release, and I have run upcp on all our servers, so I feel reasonable secure against this exploit.

  4. #49
    nat
    nat is offline
    Member
    Join Date
    Jan 2003
    Posts
    210

    Default

    Quote Originally Posted by DWHS.net
    Kind of off topic but I sure would like a script that would update all the servers with one click. I mean logging into hundreds of servers and waiting for upcp takes the extra time that could save a server from being hacked.
    You could look into Secure CRT.

    With Secure CRT you can Open up multiple SSH sessions by selecting all of the servers and clicking connect.

    You can then use the "Send chat to all tabs" feature of Secure CRT where you type in the command you want to send to ALL SSH sessions.

    1. Easily connect to all of your servers
    2. Type one command (/scripts/upcp --force)
    3. All servers are updated

    http://vandyke.com/

  5. #50
    Member
    Join Date
    Mar 2002
    Posts
    175

    Default

    Quote Originally Posted by DWHS.net
    Kind of off topic but I sure would like a script that would update all the servers with one click. I mean logging into hundreds of servers and waiting for upcp takes the extra time that could save a server from being hacked.
    I'd say now is the time to procure a copy of SecureCRT. Set up all servers in it, right click in the whitespace at the bottom and "choose Send chat to all tabs" Then every command you issue goes to all the open servers (tabs).

    But my questions is, I have all cpanel ports closed in the firewall. Is this preventing the exploit from being inserted, if it hasn't been already. And what file name can I search?

    I've also added a mod security rule

    SecUploadDir /tmp/A_folder
    SecUploadApproveScript /usr/local/apache/htdocs/viruscheck.pl
    SecUploadKeepFiles On

    So it puts any files into a folder, is this helping? Users are complaining nothing they upload through forms is working, so I know its at least preventing it,
    Last edited by jsnape; 09-23-2006 at 09:01 PM.

  6. #51
    Member
    Join Date
    May 2002
    Posts
    292

    Default

    Quote Originally Posted by jsnape
    I'd say now is the time to procure a copy of SecureCRT. Set up all servers in it, right click in the whitespace at the bottom and "choose Send chat to all tabs" Then every command you issue goes to all the open servers (tabs).

    But my questions is, I have all cpanel ports closed in the firewall. Is this preventing the exploit from being inserted, if it hasn't been already. And what file name can I search?
    Don't confuse the hostgator hack with this, the hack is a full root access hack, hostgator believes this is how their servers were compromised and inserting that code was what their hacker did with it.

    With this hack they gain full root on the box and can do anything. So you are not looking for code you are protecting your box from being rooted at the super user level.

  7. #52
    Member brianoz's Avatar
    Join Date
    Mar 2004
    Location
    Melbourne, Australia
    Posts
    1,093
    cPanel/Enkompass Access Level

    Root Administrator

    Default

    Quote Originally Posted by webtiva
    Nick, can you give us version information for what is patched? I ran an update earlier on Current machines and now see there is another version listed (12 on there now, 13 new version). Do I need to get to 13 to be safe? And how about other trees? Thanks.
    I'd like to know this too, can you please confirm the versions that are secure so we can check that we're covered?

  8. #53
    Member
    Join Date
    Mar 2002
    Posts
    175

    Default

    That's more than I knew five minutes ago. Should they even be running? What is immediate protection, shutting the server off?

  9. #54
    Member brianoz's Avatar
    Join Date
    Mar 2004
    Location
    Melbourne, Australia
    Posts
    1,093
    cPanel/Enkompass Access Level

    Root Administrator

    Default

    Quote Originally Posted by techark
    Don't confuse the hostgator hack with this, the hack is a full root access hack, hostgator believes this is how their servers were compromised and inserting that code was what their hacker did with it.
    The question is, though, does blocking the cpanel ports prevent insecure boxes from being rooted? If so, it's a good emergency measure to protect boxes until they're upgraded - better than shutting down cpanel and apache. (although perhaps just shutting down cpanel might be a solution if it doesn't terminate other essential services).

  10. #55
    Member
    Join Date
    Mar 2002
    Posts
    175

    Default

    I already updated, but cpanel inc. seems to be reluctant to say if it is actually patched. Shutting down cpanel shuts off mail, but blocking 2082 - 2095 doesn't stop smtp and pop3

  11. #56
    Member
    Join Date
    May 2002
    Posts
    292

    Default

    /scripts/upcp is the answer guys and this is a local exploit so it has to be someone with a hosting account access to to run it.

    Shutting down apache or other services does not do anything.

    It only takes a minute to update.

    No blocking ports will do no good takes less time to type /scripts/upcp anyway than to block the ports on boxes.
    Last edited by techark; 09-23-2006 at 09:17 PM.

  12. #57
    Member
    Join Date
    Sep 2003
    Location
    UK, Luton
    Posts
    197

    Default

    Quote Originally Posted by techark
    It only takes a minute to update.
    Not everyone has just one box to do!

    Here I am at 2.16AM on a Sunday morning updating our boxes.
    Regards,
    James Smith
    UH Hosting Ltd

  13. #58
    Member
    Join Date
    May 2002
    Posts
    292

    Default

    Quote Originally Posted by JamesSmith
    Not everyone has just one box to do!

    Here I am at 2.16AM on a Sunday morning updating our boxes.
    I suggest you do as others have and get a copy of SecureCRT so you can do multiple servers at once.

    Personally I have a private script set up for ours and we updated over a hundred boxes this morning in 28 minutes.

  14. #59
    Member
    Join Date
    Sep 2003
    Location
    UK, Luton
    Posts
    197

    Default

    Quote Originally Posted by techark
    I suggest you do as others have and get a copy of SecureCRT so you can do multiple servers at once.

    Personally I have a private script set up for ours and we updated over a hundred boxes this morning in 28 minutes.
    I've never had to do more than 1 or 2 together, so perhaps now I will make sure I have the ability to do multiple.
    Regards,
    James Smith
    UH Hosting Ltd

  15. #60
    Member
    Join Date
    Jun 2004
    Location
    Jonesboro, AR
    Posts
    15

    Default

    Quote Originally Posted by JamesSmith
    Not everyone has just one box to do!

    Here I am at 2.16AM on a Sunday morning updating our boxes.
    Ah, the life of a sysadmin They should provide us with free lifetime supplies of coffee.
    Michael Chase
    Clear-Data Internet Services - Inexpensive website, reseller, and game server hosting.

+ Reply to Thread
Page 4 of 19 FirstFirst ... 2 3 4 5 6 14 ... LastLast
Similar Threads & Tags
Similar threads

  1. Possible Exploit?
    By CoryHawk in forum cPanel and WHM Discussions
    Replies: 1
    Last Post: 10-03-2007, 04:31 PM
  2. Major Major Problems
    By freemchr in forum cPanel and WHM Discussions
    Replies: 0
    Last Post: 01-11-2004, 04:21 AM
  3. SSH exploit
    By sparek-3 in forum cPanel and WHM Discussions
    Replies: 19
    Last Post: 10-06-2003, 08:37 AM
  4. ProFTP Exploit
    By Angel78 in forum cPanel and WHM Discussions
    Replies: 19
    Last Post: 09-28-2003, 09:54 PM
  5. proftpd exploit
    By JamesSmith in forum cPanel and WHM Discussions
    Replies: 1
    Last Post: 09-24-2003, 12:10 AM
Linkedin       Facebook       Twitter       RSS       Flickr       YouTube