On Wed, Sep 8, 2010 at 6:17 PM, Bill Campbell <cen...@celestial.com> wrote:
> I think it's a mistake to discount any attacks involving php as > the vast majority of the systems I have had to clean up after > cracks have been compromised through php vulnerabilities, usually > in conjunction with weak user level passwords. > > IHMO, admin tools like phpMyAdmin, webmin, and usermin should be > carefully restricted, preferably only accessible via a private > LAN, not from the public internet. Use a VPN to access from the > public internet if necessary. We don't install usermin in most > cases as I have seen it used to exploit security bugs on old SuSE > systems that permit root access. Last time I checked, webmin and usermin were written in Perl ;-), no php there. If you're running a web app with a known vulnerability and it's available from the internet, then you're in trouble, that's for sure. -- natxo _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
