Sérgio Henriques

Bloquear bots no Apache

Code:

#Joomla com_jce exploit
SecRule HTTP_User-Agent "BOT for JCE" "deny,status:500,id:5000218,msg:'Joomla com_jce code exec'"

#Joomla com_jce exploit
SecRule REQUEST_URI "/images/stories/.+\.php" "deny,status:500,id:5000219,msg:'Joomla com_jce code exec'"

The first blocks the user agent. That exploit puts PHP files into site.com/images/stories/something.php if it is successful, so the 2nd rule blocks access to those in case they change user agent.

Even with the .htaccess or this first rule, you should still use the 2nd rule. Changing user agents is very simple.

 

Outra sugestão:

https://github.com/bluedragonz/bad-bot-blocker

Published by Sérgio on | Permalink

Joomla 1.5 – Permissões seguras

Colocar todas as pastas com permissão user:apache

chown -Rf user:apache public_html

Modificar as pastas para rwxr-xr-x:

find . -type d -exec chmod 755 {} \;

Modificar os ficheiros para rw-r–r–:

find . -type f -exec chmod 644 {} \;

Definir a permissão apache:apache para que algumas pastas possam ser escritas

chown apache.apache images/
chown apache.apache components/
chown apache.apache modules/
chown apache.apache plugins/
chown apache.apache language/
chown apache.apache templates/
chown -Rf apache.apache cache/
chown -Rf apache.apache logs/
chown -Rf apache.apache tmp/
chown apache.apache administrator/components/
chown apache.apache administrator/modules/
chown apache.apache administrator/language/
chown apache.apache administrator/templates/
chown apache.apache administrator/backups/
chown apache.apache administrator/cache/
chown apache.apache administrator/language/en-GB/
chown apache.apache administrator/language/pt-PT/
chown -Rf apache.apache images
chown apache.apache images/banners/
chown apache.apache images/stories/
chown apache.apache language/en-GB/
chown apache.apache language/pdf_fonts/
chown apache.apache language/pt-PT/
chown apache.apache media/
chown apache.apache plugins/content/
chown apache.apache plugins/editors/
chown apache.apache plugins/editors-xtd/
chown apache.apache plugins/search/
chown apache.apache plugins/system/
chown apache.apache plugins/user/
chown apache.apache plugins/xmlrpc/

~

Listar todos os ficheiros index.php para descobrir os modificados ou criados…

find . -name "index.php" -exec ls -alh {} \;

Listar todos os ficheiros *.php com permissões apache.apache modificados ou criados…

find . -name "*.php" -user "apache" -group "apache" -exec ls -alh {} \;

Listar todos os ficheiros do user/grupo apache com exatamente 82kb

find . -name "*.php" -user "apache" -group "apache" -size 82k -exec ls -alh {} \;

Listar todos os ficheiros modificados no dia 9 de Novembro

ls -ahlR | grep 'Nov  9'

Listar todos os ficheiros modificados no dia 20 de janeiro de 2013

tree -ifpugDs $PWD | grep "Jan 20  2013"
Published by Sérgio on | Permalink

Atualizar Joomla 1.5 para 2.5

Fica aqui o link para estudar quando tiver algum tempo….

 

http://www.joomlapt.com/dificil-atualizar-sem-megaupload.html

 

http://forum.joomlapt.com/faq-j2-5/10234-migrar-1-5-para-2-5-a.html

 

http://cmsteachings.com/how-migrate-joomla15-joomla25-part1

http://cmsteachings.com/how-migrate-joomla15-joomla25-part2

Published by Sérgio on | Permalink

Erro de JAuthentication na gestão do site

O administrador não consegue entrar na administração e surge uma mensagem de erro:

JAuthentication::__construct: Could not load authentication libraries.
Senha ou nome utilizador não são válidos

Este erro aparece porque se desactivou o plugin de autenticação do Joomla.

Para resolver este problema, acede-se à tabela jos_plugins e edita-se a linha “Autenticação – Joomla” para se alterar o campo published de “0” para “1”.

Published by Sérgio on | Permalink

Joomla: Problema com as imagens na edição de artigos

In Joomla! 1.5.8, a default filtering choice is in place for those who have not selected an Article Filter option. The default applied for those who have not made a selection implements “black list” filtering as a security precaution against possible XSS.

Due to this change, you might notice problems trying to save a Youtube video, or embedding other Javascript or Flash objects into your Articles.

If the default filtering option is not suitable for your needs, you can change it by using the Article Global Configuration options. For example, to change the default settings so that no filtering happens for members of the Super Administrator group:

1. Navigate to Content -> Article Manager.

2. Press the Parameters icon in the toolbar to show the Articles – Global Configuration screen.

3. Scroll down to Filtering Options, highlight all Filter groups except Super Administrator, Administrator and Manager, and select Filter type of Blacklist (Default), as shown in the screenshot below.

With this setting, Joomla! will use the default Blacklist filter for all users except for the Super Administrator, Administrator and Manager groups. If you want to let other groups of Users submit content with no filtering, just modify the instructions above to exclude these groups. If you want no filtering on any groups, follow the instructions above but select only the Registered group.

 

Published by Sérgio on | Permalink