Live data from Hacker News

1% of CMS-Powered Sites Expose Their Database Passwords (2011)

feross.org

41–50 of 94 posts

Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)

#42
post #20

While this is bad of course, you also would have to allow network access to your mysql from remote ips. Which if allowed is even more stupid. If you run mysql only locally then do skip-networking and if you have to have networking restrict the ips it's allowed from. If they can use the mysql password locally, well then you have far bigger problems with security than mysql and exposed php configuration files.

Wonder how many use the same password for ssh and mysql though

Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)

#44
post #15

Earlier quoted context omitted.

You are correct, you could do almost exactly the same thing in "the whole shitty PHP way of doing things" using FPM pools.

Excellent! Part of me wants to have a play and see how closely I can get a PHP/FPM/nginx to resemble my Python/uWSGI Emperor/nginx stack. You can do stuff like include /srv/*/pool.ini, right?

Yes you can. Dotdeb's php-fpm.ini even includes this line by default:

    ; To configure the pools it is recommended to have one .conf file per
    ; pool in the following directory:
    include=/etc/php5/fpm/pool.d/*.conf
Then you could configure ENV inside FPM pool using the env directive:

    env[DB_HOST] = localhost
    env[DB_USER] = foobar
    env[DB_PASSWORD] = foobar
...and use something like this in e.g. Wordpress config:

    define('DB_NAME', getenv('DB_NAME'));
    define('DB_USER', getenv('DB_USER'));
    define('DB_PASSWORD', getenv('DB_PASSWORD'));
The biggest caveat is you MUST disable phpinfo()

    php_value[disable_functions] = phpinfo
Otherwise these ENV will shown up in any page that calls phpinfo();

Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)

#45
0. Put local config files outside of webroot or other publicly accessible directories, include programatically.

1. Disable swap/backup files in your editor (or write them to a different location)[1]

2. Git ignore or SVN ignore swap files and backup files

3. Configure your web server to not serve such files.

Some combination of these should keep you safe. :)

[1]: in vim: noswap nobackup nowritebackup or http://vim.wikia.com/wiki/Remove_swap_and_backup_files_from_...

Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)

#46
post #41

To find VIM swp files you can run this command on your public_html directory: find . -name "*.swp" You can find and remove them with: find . -name "*.swp" -exec rm -f \{\} \;

A solution using xargs instead of exec:

find . -name "*.swp" | xargs rm

I believe find -exec forks and execs once for every file found, xargs may only fork and exec once, provided that all of the files find finds fit in a single command line. Hopefully not an issue in this case, but it can greatly speed up a deletion when you have a lot of files to find and delete.

[EDIT] Doesn't properly handle spaces in filenames, see the comments below for other slick solutions.

Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)

#48
post #41

To find VIM swp files you can run this command on your public_html directory: find . -name "*.swp" You can find and remove them with: find . -name "*.swp" -exec rm -f \{\} \;

A solution using xargs instead of exec: find . -name "*.swp" | xargs rm I believe find -exec forks and execs once for every file found, xargs may only fork and exec once, provided that all of the files find finds fit in a single command line. Hopefully not an issue in this case, but it can greatly speed up a deletion when you have a lot of files to find and delete. [EDIT] Doesn't properly handle spaces in filenames,…

Please don't run the command above, it doesn't handle spaces. You might delete something you didn't intend to delete.

You need to add -print0 to find, and -0 to xargs to make it work properly: find . -name "*.swp" -print0 | xargs -0 rm

But better would be to use -delete as I wrote above.

Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)

#49
post #41

To find VIM swp files you can run this command on your public_html directory: find . -name "*.swp" You can find and remove them with: find . -name "*.swp" -exec rm -f \{\} \;

A solution using xargs instead of exec: find . -name "*.swp" | xargs rm I believe find -exec forks and execs once for every file found, xargs may only fork and exec once, provided that all of the files find finds fit in a single command line. Hopefully not an issue in this case, but it can greatly speed up a deletion when you have a lot of files to find and delete. [EDIT] Doesn't properly handle spaces in filenames,…

Technically, your solution does not work with files whose name contain a space or newline. A working solution is either to do '-print0' in find and '-0' in xargs, or to just use '-delete' instead of the -exec. It is also possible to use '+' instead of ';' with '-exec' to say "fork as few times as possible", ie pack the largest list of arguments to rm you can. But '-delete', when supported, won't even fork/exec.

Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)

#50
post #49

Earlier quoted context omitted.

A solution using xargs instead of exec: find . -name "*.swp" | xargs rm I believe find -exec forks and execs once for every file found, xargs may only fork and exec once, provided that all of the files find finds fit in a single command line. Hopefully not an issue in this case, but it can greatly speed up a deletion when you have a lot of files to find and delete. [EDIT] Doesn't properly handle spaces in filenames,…

Technically, your solution does not work with files whose name contain a space or newline. A working solution is either to do '-print0' in find and '-0' in xargs, or to just use '-delete' instead of the -exec. It is also possible to use '+' instead of ';' with '-exec' to say "fork as few times as possible", ie pack the largest list of arguments to rm you can. But '-delete', when supported, won't even fork/exec.

Are these GNU find extensions? I spend a lot of time on solaris, and I don't remember seeing a delete option. Thanks for the tips though!
Post reply on HN