Interesting security concern. It might be added that if one has several backup files, and has MultiviewsMatch enabled, the files aren't actually readable but get run instead. This is because multiple backups get numbered after a dot, while single backups and crashed files do not.
1% of CMS-Powered Sites Expose Their Database Passwords (2011)
21–30 of 94 posts
Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)
#22While this is bad of course, you also would have to allow network access to your mysql from remote ips. Which if allowed is even more stupid. If you run mysql only locally then do skip-networking and if you have to have networking restrict the ips it's allowed from. If they can use the mysql password locally, well then you have far bigger problems with security than mysql and exposed php configuration files.
You can always try to append "/phpMyAdmin" to the root url, you'd be surprised how often that works.
Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)
#23Quite an old issue (2011), did anybody run the script to see if as many sites still publicly expose these files?
Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)
#24How utterly stupid do you have to be to engineer software that requires you to have configuration files in a publicly accessible folder? Even most shared hosts now will have a public_html folder and the ability to put sensitive stuff not inside it. The .htaccess hacks are great but they are just patching the symptom, and one slip up and you're back to square one. The best way to do configuration is to have it in envi…
Because your average graphics designer or blogger has no idea what Apache is, what public directories or file permissions are. They just want to run their own blog. That's why Wordpress (or PHP for that matter) is successful; it's easy to set up and get started.
Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)
#25Quite an old issue (2011), did anybody run the script to see if as many sites still publicly expose these files?
It would also be interesting to know if any of the big CMS vendors (Automattic, Drupal etc) has done anything to prevent this in the newer releases.
Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)
#26The title of the linked post is 1% of CMS-Powered Sites Expose Their Database Passwords - has it changed since submission?
Could be HN mod editorialising at work
Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)
#27The author helps with an Apache rule:
Order allow,deny Deny from all
What would be the equivalent of this for Nginx?
Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)
#28The first time I read a vulnerability report about text editor backup or swap files being served as pain text was probably in the mid-to-late-90s
Some things never change.
Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)
#29 "If the text editor crashes or the SSH connection drops during editing"
Re: 1% of CMS-Powered Sites Expose Their Database Passwords (2011)
#30The title of the linked post is 1% of CMS-Powered Sites Expose Their Database Passwords - has it changed since submission?
Could be HN mod editorialising at work
Don't start assuming without evidence. I don't support the changing of titles, but I'm not going to blame the mods for something they didn't do.