Server Administration Help - Limit WGET and other SSH commands to root only
Poorly programmed scripts can usually allow an attacker to force the apache user to load unwanted scripts to youer server.
This is usually done by excuting a wget command to a globally writable folder, usualy in /tmp.
As normal users do not have SSH access at all ( and its strongly suggested you do not give them any access ), the only person that would actually use SSH and WGET would be the server admin or the root user.
Excute the below to make several features only accessible by the root user.
chmod 750 /usr/bin/rcp
chmod 750 /usr/bin/wget
chmod 750 /usr/bin/lynx
chmod 750 /usr/bin/links
chmod 750 /usr/bin/scp
Sometimes the file may or may not be in the directories I listed, so please do a locate if things fail.
Back to FaQ Section
|
|
