Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1% of CMS-Powered Sites Expose Their Database Passwords (2011)

feross.org

Post reply on HN
Print view View original

11–20 of 94 posts

Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)

#11

Post by analog »

josefresco wrote: post #2

To protect the wp-config.php file using htaccess is a well known security precaution for any WP pro. The issue however is if you have a copy of said file, in which case protecting the main version would be useless. Also I'd say the blame if you can assign any is on Vim, Emacs, Gedit, and Nano which would have had to crash in order to set these chain of events in motion.

Why would they not have a config folder which uses .htaccess to protect everything inside? That would close this vulnerability without affecting convenience.

Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)

#14

Post by damncabbage »

josefresco wrote: post #2

To protect the wp-config.php file using htaccess is a well known security precaution for any WP pro. The issue however is if you have a copy of said file, in which case protecting the main version would be useless. Also I'd say the blame if you can assign any is on Vim, Emacs, Gedit, and Nano which would have had to crash in order to set these chain of events in motion.

> Also I'd say the blame if you can assign any is on Vim, Emacs, Gedit, and Nano

... Or the guy who is just editing files directly on the server (or shovelling everything up with FTP), instead of sane version control.

(I'm not sure anyone doing the former can be counted as "Pro", WP or otherwise.)

Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)

#15

Post by Kudos »

antihero wrote: post #5

How utterly stupid do you have to be to engineer software that requires you to have configuration files in a publicly accessible folder? Even most shared hosts now will have a public_html folder and the ability to put sensitive stuff not inside it. The .htaccess hacks are great but they are just patching the symptom, and one slip up and you're back to square one. The best way to do configuration is to have it in envi…

You are correct, you could do almost exactly the same thing in "the whole shitty PHP way of doing things" using FPM pools.

Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)

#16

Post by IgorPartola »

josefresco wrote: post #2

To protect the wp-config.php file using htaccess is a well known security precaution for any WP pro. The issue however is if you have a copy of said file, in which case protecting the main version would be useless. Also I'd say the blame if you can assign any is on Vim, Emacs, Gedit, and Nano which would have had to crash in order to set these chain of events in motion.

vim lets you choose where to put swp/backup files. Mine are always in ~/.vim/tmp. Avoids awkward issues with scripts that operate on the current directory recursively. And no, you cannot blame shitty security on a text editor.

Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)

#17

Post by IgorPartola »

analog wrote: post #10
MattBearman wrote: post #7

This is why everything except a font accessor (index.php) should be stored in a directory behind the publicly accessible web root directory. It's standard practice for most web frameworks, and yet it seems the most popular CMSs don't bother.

It would make the CMSs harder to deploy, security gets traded off for convenience.

Apache could make this very easy. The default htaccess file could set this up.

Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)

#18

Post by eksith »

For the majority of users that use PHP: A lot of hosts now allow editing of php.ini which isn't accessible to the web (or else it's time to switch hosts).

You can store the login credentials there : http://www.php.net/manual/en/pdo.construct.php

This is another reason why you should move away from mysql(i) to PDO.

Or if that doesn't work, try storing in the .htaccess or Apache conf environment variables : http://stackoverflow.com/a/2583857

Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)

#19

Post by jsmeaton »

josefresco wrote: post #2

To protect the wp-config.php file using htaccess is a well known security precaution for any WP pro. The issue however is if you have a copy of said file, in which case protecting the main version would be useless. Also I'd say the blame if you can assign any is on Vim, Emacs, Gedit, and Nano which would have had to crash in order to set these chain of events in motion.

Our tutor in my first year uni course taught us to put sensitive information into a folder outside the web path, and use relative paths to include the files where needed. There is absolutely zero reason these sensitive files should be accessible via URL.

Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)

#20

Post by ck2 »

While this is bad of course, you also would have to allow network access to your mysql from remote ips.

Which if allowed is even more stupid.

If you run mysql only locally then do skip-networking and if you have to have networking restrict the ips it's allowed from.

If they can use the mysql password locally, well then you have far bigger problems with security than mysql and exposed php configuration files.

Post reply on HN