My site was hacked, how can I use chmod permissions to avoid this?

Question

To be honest, only the home page was switched (even the text that was modified bragged about this, grrrr!), but still... not pleasant at all.

So the important question, and something that was on my mind for a long time but never got around to ask:

which files MUST be read-only or what kind of permissions should I had to enforce in which files to make this at least a bit more difficult?

Thanks in advance.

It's also important to understand that security is a complicated topic, and file permissions is just a single link in a very long chain. The chain is no stronger than it's weakest link. — Letharion, Commented Feb 20, 2012 at 15:41
buddy you deserve a monster congrats for raising this question. Mille Grazie. Note i also hat such troubles — zero, Commented Feb 20, 2012 at 17:39
@Letharion: I absolutely agree with you. This is just one of the many steps I will be analyzing and learning this week. — MauF, Commented Feb 20, 2012 at 18:42
@zero: glad to be of service, zero. hope you get back online soon. — MauF, Commented Feb 20, 2012 at 18:43

acouch · Accepted Answer · 2012-02-20 15:39:48Z

10

You also might want to try adding the Security Review module to help make sure your site is following the correct file permission settings.

answered Feb 20, 2012 at 15:39

acouch

2,61417 silver badges22 bronze badges

1

Glad to help. If you approve of the answer you should "accept" it. It provides closure for the question and rewards the answerer. It also improves the "answer rate" for the entire community. See: meta.stackexchange.com/questions/5234/…
– acouch
Commented Feb 20, 2012 at 16:13
count ont it, acouch. one quick question: how long does the secutity review usually take? i've ran it three times, but I haven't gotten any results. i will read more atoub it in the documentation, but i was just wondering.
– MauF
Commented Feb 20, 2012 at 18:44
It depends on how big your site is, how fast your server is, and how much memory PHP has been granted. On a test site for me it only took a few seconds. There are drush commands you can use if you have that installed "drush secrev" which may be a faster.
– acouch
Commented Feb 20, 2012 at 18:51
1

also we should thank greggles: drupal.stackexchange.com/users/694/greggles and coltrane:drupal.stackexchange.com/users/538/bjeavons for their work in this area
– acouch
Commented Feb 20, 2012 at 18:53
1

Great answer to the specific question and thanks for the kudos :) I wonder if file permissions were really how the attacker got in. To MauF - do you have some specific evidence that this was the problem?
– greggles
Commented Feb 21, 2012 at 3:29

Add a comment |

1 Answer 1