how can i block visitors from a provider.

roelof · 2008-05-06 18:32:49

Hello,

Since 1 March there are some people which try to hack my site.
I have tried to block this with .htaccess which look like this :

#DirectoryIndex index.php index.html

#Options +FollowSymLinks
#Options -Indexes

<IfModule mod_rewrite.c> RewriteEngine On #RewriteBase /relative/web/path/

RewriteCond %{REQUEST_FILENAME} -f [OR] RewriteCond %{REQUEST_FILENAME} -d RewriteRule ^(.+) – [PT,L]

RewriteRule ^(.*) /index.php

RewriteCond %{HTTP:Authorization} !^$ RewriteRule .* – [E=REMOTE_USER:%{HTTP:Authorization}]
</IfModule>

#php_value register_globals 0

Order Deny,Allow
Deny from *.cable.casema.nl
Allow from all

But it doesn’t work. Blocking from ip-adres doesn’t work either because they can change thier ip-adress.

Who has another idea ?

Roelof

Gocom · 2008-05-06 18:41:27

How are they trying to “hack” your site?

roelof · 2008-05-06 18:45:50

By using this sort of url’s : index.php?option=http://nsmsisoeueeitsdwfdfhfrdefaiss.land.ru/.html/head?

Roelof

Gocom · 2008-05-06 18:57:32

roelof, no hacking, just script kiddies and importantly it doesn’t do anything, so don’t worry :)

<Limit GET>
order deny,allow
deny from .cable.casema.nl
allow from all
</Limit>

That should do it.

Last edited by Gocom (2008-05-06 18:58:41)

ruud · 2008-05-06 19:09:49

If all those IPnrs are from the same ISP, send detailed log files to the abuse email address of that provider.

If those page requests really did harm (which doesn’t appear to be the case here), the solution would not be to block the IPnrs where these requests originate, but rather to fix the hole that allows them to abuse your website.

roelof · 2008-05-06 19:18:41

Hoi GoCom,

Thank you for your help.
I will try this.

Ruud,

I agree with you. But fixen i can’t do. Im not a programmer,
And this annoyes me a lot.

Roelof

uli · 2008-05-07 11:38:19

ruud wrote:

[…] but rather to fix the hole that allows them to abuse your website.

From what I read here (inserted <?php include('images/faq.php'); ?>) disabling the use of PHP in the preferences is one way to do so, right? The FAQ page doesn’t really help here. What can I do wrong with TXP itself concerning this issue?

Last edited by uli (2008-05-07 11:42:40)

ruud · 2008-05-07 13:21:54

Disabling the execution of <txp:php> tags (or raw PHP tags) in TXP doesn’t really help, unless you have untrusted users that can post articles in TXP. Other than that specific situation, TXP itself should be safe without requiring any action from the user (apart from keeping TXP up-to-date of course).
If this were not true, TXP would have a security hole and that should be fixed.

uli · 2008-05-07 13:42:33

ruud schrieb:

Disabling the execution of <txp:php> tags (or raw PHP tags) in TXP doesn’t really help, unless you have untrusted users that can post articles in TXP.

In the example I linked someone succeeded in cracking the account password and thus could change the index.php. Disabling php execution wouldn’t EDIT: ~~help here~~ stop that code from getting executed? Sorry for asking stupid questions, but I’m not aware of what is possible if you’ve got bad skills.

Last edited by uli (2008-05-07 13:52:05)

ruud · 2008-05-07 20:22:23

If someone has cracked the hosting account password, they can do whatever they want: install software, modify files, reconfigure existing software. Once that happens, there’s just one solution: throw it all away (perhaps save a copy for analysis) and start from scratch.

Disabling PHP execution in TXP doesn’t completely disable the execution of PHP, because TXP itself is a collection of PHP scripts, so it requires PHP code to be executed in order to run. The only thing that preference does is determine whether you can add your own PHP code in templates, forms and articles. As an administrator, you can limit what lower privileged users are allowed to do (so that preference setting does help to limit the damage of a cracked low priviledge TXP user account)… but if someone gained access to your TXP administrator password, it not longer matters how you set that preference, because the cracker could change the preference himself. And more: install plugins, delete articles etc.

Keep asking questions if you have them. Probably one of the more important steps in increasing security is to start asking questions and to become aware of potential problems. Lack of knowledge is a security risk. Any attempt to remedy that cannot be stupid.

colak · 2008-05-08 05:20:08

uli wrote:

In the example I linked someone succeeded in cracking the account password and thus could change the index.php. Disabling php execution wouldn’t EDIT: ~~help here~~ stop that code from getting executed? Sorry for asking stupid questions, but I’m not aware of what is possible if you’ve got bad skills.

Hi uli, the example you posted concerns wordpress which is a totally different software.

uli · 2008-05-08 12:36:40

ruud, thanks for explaining!

colak, yup, different ;)
But by sayin that, you don’t mean that an intruder with the described potential would turn his back on a TXP installation, do you? ;)

What about putting scripts containing the unencrypted db password on the same server than the installation is on? Doesn’t matter anymore, accessed is accessed? I just wondered about a script I found proposed around here.

(Maybe this thread should be transferred to General Discussions.)

Textpattern CMS

Textpattern CMS support forum

#1 2008-05-06 18:32:49

how can i block visitors from a provider.

#2 2008-05-06 18:41:27

Re: how can i block visitors from a provider.

#3 2008-05-06 18:45:50

Re: how can i block visitors from a provider.

#4 2008-05-06 18:57:32

Re: how can i block visitors from a provider.

#5 2008-05-06 19:09:49

Re: how can i block visitors from a provider.

#6 2008-05-06 19:18:41

Re: how can i block visitors from a provider.

#7 2008-05-07 11:38:19

Re: how can i block visitors from a provider.

#8 2008-05-07 13:21:54

Re: how can i block visitors from a provider.

#9 2008-05-07 13:42:33

Re: how can i block visitors from a provider.

#10 2008-05-07 20:22:23

Re: how can i block visitors from a provider.

#11 2008-05-08 05:20:08

Re: how can i block visitors from a provider.

#12 2008-05-08 12:36:40

Re: how can i block visitors from a provider.

Board footer