Web server hacked!

[n5gooner]

Hi all,


right, my web server keeps getting hacked and malware keeps being installed. I know I need to edit the .htaccess but I don't know what too.

This is the current file...

# $Id: .htaccess 1739 2007-12-20 00:52:16Z hpdl $
#
# This is used with Apache WebServers
#
# For this to work, you must include the parameter 'Options' to
# the AllowOverride configuration
#
# Example:
#
# <Directory "/usr/local/apache/htdocs">
# AllowOverride Options
# </Directory>
#
# 'All' with also work. (This configuration is in the
# apache/conf/httpd.conf file)

# The following makes adjustments to the SSL protocol for Internet
# Explorer browsers

#<IfModule mod_setenvif.c>
# <IfDefine SSL>
# SetEnvIf User-Agent ".*MSIE.*" \
# nokeepalive ssl-unclean-shutdown \
# downgrade-1.0 force-response-1.0
# </IfDefine>
#</IfModule>

# If Search Engine Friendly URLs do not work, try enabling the
# following Apache configuration parameter

# AcceptPathInfo On

# Fix certain PHP values
# (commented out by default to prevent errors occuring on certain
# servers)

# php_value session.use_trans_sid 0
# php_value register_globals 1
DirectoryIndex index.php
php_value error_reporting 0
php_value auto_append_file /srv/www/vhosts/digiscanltd.com/httpdocs/htaccess


It doesn't look like its doing anything to me, but I'm rather green with it all.

Any help would be appreciated....

Many thanks

Gooner.

[Sysman]

Have you got Apache mod_security installed?

From HowToForge.com:

This article shows how to install and configure mod_security. mod_security is an Apache module (for Apache 1 and 2) that provides intrusion detection and prevention for web applications. It aims at shielding web applications from known and unknown attacks, such as SQL injection attacks, cross-site scripting, path traversal attacks, etc.

[n5gooner]

haven't got a clue!!!

I'll see if I can find out!

[administrator]

The htaccess file looks fairly harmless to me. Why do you think you need to edit it?

If you need any help PM me, been hacked more than once and happy to have a look at your machine if you need to.

[yorkshireman]

I think you need to take a step backwards here. For instance if your website is running on a content management system like say Joomla (which is excellent btw) then it is essential you patch it when security vulnerabilities are discovered.

You really need to give a bit more detail on the configuration and the type of hacking that has taken place before you can get much help here.