Yoni Posted January 6, 2012 Report Share Posted January 6, 2012 I have tried to tight up my server as much as possible. Uniform Server seems to be pretty much secure right out of the box but I have some concerns for those who, like me, run their servers in production open to the world. The first thing that I noticed was apache and mysql services running as Administrator. I understand .vbs scripts and .bat files cannot run in Windows without elevated privileges in some cases; this is not one of them though. For all those running Uniform Server as Administrator, please reconsider your NTFS permissions! and the account(s) your apache and MySQL services are running under. I'm attaching a securitycheck.php file to my post. Upload that to your wwwroot and browse to it over http. Welcome to the show! And be extremely careful while testing your security. You will find it crazy but you will have full access to your system because that script is being executed under apache AS ADMINISTRATOR, without proper NTFS permissions your entire server is ONE click away from being wiped out. These are the basics to understand why your NTFS permissions are so darn important and shouldn't be ignored under IIS, apache or any other http server. In my personal case, I have created 2 new users (1 for apache, 1 for MySQL) and 1 Group to manage NTFS permissions more easily). 1 - Create your 2 user accounts (apache, mysql). Make sure the user CANNOT change the password and also the PASSWORD NEVER EXPIRES.2- Create a new group (let's call it webservices1).3- Add apache and mysql users to that group (webservices1).4- HOST your Uniserver Folder off of your C: drive (that's your OS drive after all)5- Deny ALL permissions to webservices1 GROUP (apache and mysql users) to C:6- Deny delete and WRITE to your Uniserver folder. Propagate permissions and allow WRITE only where required, ex: X:/Uniserver/tmp8- Make sure mysql service has MODIFY permission to /Uniserver/usr/local/mysql9- Make sure apache service has MODIFY permission to apache logs or the service won't start10- Make sure you go to services and change US_APACHE1 and US_MYSQL1 to run with the new credentials created in step1. There is a lot more to do and denying DELETE might be inconvenient to some admins when updating files but it is a lot more secure. It takes 10 seconds to edit NTFS security permissions (enable DELETE), update your server files, apps, etc. Go back and DENY delete. Hope this helps some of us.securitycheck.zip Quote <p class="bbc_center"><span style="font-size:12px;"><strong>Yoni</strong></span></p> Link to comment Share on other sites More sharing options...
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.