Re: httpd - mysql - paypal.com.tar - hacker

[Jim Perrin <jperrin@xxxxxxxxx>]

On Fri, Aug 21, 2009 at 5:31 PM, Ray Van Dolson<rayvd@xxxxxxxxxxxx> wrote:

>
> Nope, but you can take steps to prevent (or make it more difficult) for
> people that shouldn't be accessing it from accessing it.
>
> Apache allow from, etc... basic authentication, make sure you're using
> HTTPS and selinux.

Along these lines (following up here, though it's mostly to the OP),
you may also want to look at your php.ini for some hardening as well.
The default php.ini ships with allow_url_fopen enabled, which tells
php to treat remote files like they're local. In some cases this is
needed, but I really consider it a huge security hole, and if
disabling doesn't break your website, I would suggest you do so.


-- 
During times of universal deceit, telling the truth becomes a revolutionary act.
George Orwell
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos