Flipping Heart grrrr

Just got an email from then saying you're running a permanent server process which is against the T+C's scripting has been disabled on your package blah blah blah.

Now I wouldn't mind but the only scripting running is Joomla and that was installed from THEIR control panel and THEIR installer, grrrrrrr.

No notice nothing just disable scripting and kill the site ffs!!!!!!

Have you gave Tech Support a go, I found them quick to help with my issues...

Yeah I was waiting for tech supports reply when I posted

Seems the Joomla install they provided wasn't particularly secure (well I know don't assume anything....) despite the post install page saying there are no known security flaws in Joomla it's all down to 3rd party plugins/modules etc (which I didnt have installed).

Tech supports advice delete the whole site and start again, luckily it was just a test before migrating the existing site to Joomla but I was not best pleased.

Since then i've done some research and hardened the install and also set it up to use SSL for access the back end, as well as removing the default account and CHMODing all files and folders, disabling key things in the php.ini and making a few changes in the .htaccess file so fingers crossed that's enough to keep it secure.

II'll leave it a few weeks and see if it gets compromised again lol

"Seems the Joomla install they provided wasn't particularly secure"

joomla and mambo aren't particularly secure.

We have seen many issues with our clients installing joomla and then causing issues in general...

"II'll leave it a few weeks and see if it gets compromised again lol "

froom a hosting point of view - site compromises can be a major pain - especially if its a phishing site and you get a lovely letter from the bank/paypal/ebay briefs ...

Edited by Taras (Mon 02-Feb-09 15:43:17)

I did say to Heart if it's something they are going to offer to preinstall they should either harden it themselves or at the very least give the EU some advice their post install script actual says There are no security flaws in Joomla blah blah blah and I made the critical error of assuming someone at their end was doing the right thing

In reply to:

---

joomla and mambo aren't particularly secure.

---

Do you have any pointers for further information on this? (My brother has contracted out the rebuild of a fairly high volume, semi commercial site to a hosting company who are implementing it on Joomla. It would be nice to know what questions to ask.)

http://www.google.co.uk/search?q=securin...

There are several things that are easy to do

use the .htaccess file to lock it down
There are certain php bits you can disable like fopen
I now have the site running over SSL and i'm going to set it up so that the whole back end is SSL and the front end is not (for speed reasons you dont want the whole site as SSL)

It's amazing how much you can pick up after just a little reading

We have seen injections of websites (ie phising sites) in to the various writable (777) folders.

Things like

"Security

One low-level and one high-level security issue were fixed in this release:

* High Priority: Directory Traversal. A crafted request can allow an attacker to view directory trees on the server. Note: contents of files cannot be edited or deleted, just viewed. More information »
* Low Priority: SSL Session Token Disclosure. When running a site as SSL ONLY, if a non-SSL request is made, an attacker can obtain the session token. There is NO risk for Web sites that use both HTTP and HTTPS. More information »
"

http://www.joomla.org/announcements/rele...

Do not inspire us to use joomla for a semi commercial site.

You shouldn't have any folders left as 777 from my understanding