nixCraft

Dear List,

I had implemented Mod Security 1.9 in a Debian 3 Server. My Apache Version is 1.3, and log says that its working fine. I had secured my /tmp /var/tmp /dev/shm directories. And umounted in /etc/fstab. But Yesterday,one attacker had upload a perl script into my /tmp directory.
Please let me know which SecFilter rule should I add to prevent a intruder to uploading Perl/Sh/Chsh scripts into the /tmp directories.

Thanks in Advance.

The best way to avoid /tmp upload is mount tmp on its own partition and setup noexec mount flag. Also make sure you run susexe for PHP.

Ultimate solution is install mod_security for Apache and chroot jail (it may not not work with CP such as Plesk)

Hope this helps

__________________
May the force with you!