[resolved] Possible Security Issue

Security issues should be emailed directly to security@cpanel.net so they can be addressed in a prompt manner.

Remember, the cPanel Staff is not made aware of every thread posted here. While we attempt to assist those posting to the forum where appropriate - many threads may "fall through the cracks." It is for this reason (among many others) the forums are not an official means of communication and it is strongly encouraged that official communications with the cPanel Staff be handled through official channels rather than via the community forums.

 

Interesting.

But why would you do remote FTP backup to the same account?

 

I'm trying to get a grasp on this. You are sending all backups for a server to a specific account on the same server over ftp?

What files contain root passwords? It's only account tarballs that are backed up. Here's a FTP backup to my account from the same server:

Code:

dave@server1 [~/cpbackup]# cd monthly/
dave@server1 [~/cpbackup/monthly]# ls
./   domain1.tar.gz       domain2.tar.gz   domain3.tar.gz   reseller.tar.gz
../  domain4.tar.gz  domain5.tar.gz  
dave@server1 [~/cpbackup/monthly]# cd ..
dave@server1 [~/cpbackup]# cd weekly/
dave@server1 [~/cpbackup/weekly]# ls
./   domain1.tar.gz       domain2.tar.gz   domain3.tar.gz   reseller.tar.gz
../  domain4.tar.gz  domain5.tar.gz  
dave@server1 [~/cpbackup/weekly]# cd ..
dave@server1 [~/cpbackup]# cd daily/
dave@server1 [~/cpbackup/daily]# ls
./   domain1.tar.gz       domain2.tar.gz   domain3.tar.gz   reseller.tar.gz
../  domain4.tar.gz  domain5.tar.gz  

 

I did a grep -R "account:rootpass" * in my backup directory after extracting the archive and got no takers.

Code:

dave@server1 [~/cpbackup/daily]# tar -xzf reseller.tar.gz 
dave@server1 [~/cpbackup/daily]# cd reseller
root@server1 [/home/dave/cpbackup/daily/reseller]# grep -R "reseller:XXXX" *
root@server1 [/home/dave/cpbackup/daily/reseller]#

XXXX intentionally obfuscated

 

Yeah I'm not seeing it either.

Not sure how this would be any different than backing up to a regular 'ole remote ftp server. Files is files, and ftp is ftp, eh?

 

I can not duplicate this on any of my servers.

 

I'm changing this thread's title as it is not valid