The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

cpanel security

Discussion in 'Security' started by cyberspirit, Aug 4, 2003.

  1. cyberspirit

    cyberspirit BANNED

    Jun 27, 2003
    Likes Received:
    Trophy Points:
    It seems that once again cpanel security was in the news. I would highly recommend that the cpanel team makes a strong effort to make cpanel more secure if they want to compete with other systems.
    I personally do not feel good about using a system that seems to be in the news all the time. See this article for further info:

    Defacement contest likely to target Web hosting firms
    By John Leyden
    Posted: 03/07/2003 at 11:53 GMT

    A defacement challenge scheduled for Sunday is likely to target Web hosting companies rather than individual Web sites.

    Defacement archive site Zone-H reasons that crackers will target Web sites they have already rooted because of the limited time set aside for the challenge.

    The 'rules' of the challenge state that there will not be any difference when counting a single defacement (single IP) or a mass-defacement (many domain names on the same IP), so Zone-H reasons, hosting firms will be the main target.

    "Given time frame will be only six hours, what is mostly going to happen is that a lot of Web hosting companies will be hit, instead than single servers belonging to different companies," Zone-H reports.

    Due to the sharp decrease of the defacement over the last few days, Zone-H reasons crackers rooting possible targets without defacing them, so to be ready with a lot of ready-to-be-defaced targets to be used on the contest day. The defacement competition challenges crackers to deface as many as 6,000 sites in the shortest time possible to win the contest.

    Point values are based on the operating systems hacked and defaced. HP-UX, Apple, and IBM-AIX are worth more points due to their limited use as Web-hosting platforms, and because they are targeted less often than Microsoft and Linux-based systems.

    Zone-H is forecasting anywhere from 20,000 attacks might arise from the challenge. However it is downplaying fears that mass disruption of Internet services due to the attacks.

    "A mass-defacement (even of several thousands domain names) is usually conducted opening a single connection to the attacked server," it reasons.

    Defacement attacks occur all the time, not only during a mass hacking contest. But in the run up to the latest hacking spree there's all the more reason to shore up security defences.

    Zone-H recommends the following general security precautions to sysadmins:
    Download and apply all security patches

    Shut down all the unnecessary modules on a Web server

    Close all the unnecessary ports
    It's also a wise precaution to check for the presence of any backdoor/rootkit on systems. Tell tale signs include: freshly added unknown users, suspicious connections on open port and suspicious shell program. Spotting these kinds of problems is where vulnerability scanners come in useful.

    Finally, in the know thy enemy category, Zone-H, reminds sysadmins of the most common vulnerabilities targeted by defacers. These include flaws in the following packages/services: OpenSSL, Samba, Webdav, Frontpage extension misconfiguration, AIX ftpd, Solaris telnetd, Sendmail, Wuftpd, Proftpd, PHPnuke (not for mass defacement but still an ever present risk), OmniBack II and Cpanel.

    Let's be careful out there. ® Support Ticket Number:
  2. haze

    haze Well-Known Member

    Dec 21, 2001
    Likes Received:
    Trophy Points:
    1. Thats old
    2. It would most likely affect those that do not upgrade their versions of cpanel.
    3. cpanel does a fine job of updating software, even compared to other systems.
    4. its not cpanels responsibility to secure a box, that is what a system admin is for. Support Ticket Number:
  3. myusername

    myusername Well-Known Member

    Mar 6, 2003
    Likes Received:
    Trophy Points:
    chown -R us.*yourbase*
    cPanel Access Level:
    DataCenter Provider
    Did you mention that was like 3 weeks ago's news? Support Ticket Number:

Share This Page