1

I have been having troubles with the attackers attacking to my Joomla sites. They create some php files which are encoded with base64 algorithm in the directories of which chmod values are 774 or higher.

In order to upload pictures via administrator panel's media manager, I have to set images directory's chmod value to 774. So the attacker appends some malicious php files into this directory.

I have an idea that could help but do not know how to do it. Is it possible to set chmod to 774 right after logging into Joomla administrator panel and set back to 755 after logging out.

This is not a sharp solution but it reduces the probability of getting damage from attacks.

2

This is normally due to the folder having an owner different from what Joomla is running under. The most common case is having PHP running under mod_apache and having copied Joomla! by FTP.

There are three solutions (best first):

  1. Change from Apache to CGI/FCGI PHP. This rans using your account which should match the folders. Unfortunately this generally requires service provider action and they will generally refuse to do it, but you should ask anyway as they may agree or be able to move you to a server with different configuration. Some server control panels allow the user to choose the PHP API used with Apache being often the default since it uses somewhat less resources and used to be faster.

  2. Configure Joomla! to use FTP for file access in Joomla! site settings. If you use same account (or an account in the same group?) everything should work. The downside is that the FTP is somewhat painful to configure as finding the correct basepath can be a pain, if you have no prior experience. You can find it with PHP code and it is usually visible somewhere in the server control panel. FTP is also much slower, but writes are generally rare enough for this not to be a serious issue.

  3. Change the owner of the image folder. chown works fine if you can use command line. Otherwise just copy the folder, remove the original, and restore it using a PHP based file manager. The file manager would presumably ran under the same owner as Joomla! and everything should work. The downside is that this messes up your security so you do not want to do it for all files and folders, but when installing updates Joomla! actually occasionally needs to write to any folder and quite often to temp and cache.

There is a related article http://www.dionysopoulos.me/2010/07/

And lots of other articles on the web. This is one of the most common server issues.

  • Second suggestion is my solution. – zkanoca Jan 14 '15 at 15:08
0

Directory or file permissions are a security measure, but they are not the main issue.

Your site has an open vector of attack. Intruders have found an open door in your site. E.g. an old extension from an unknown source or an outdated server.

Start to secure your site with this checklist: https://docs.joomla.org/Security_Checklist

  • Getting Started
  • Hosting and Server Setup
  • Learn about file permissions
  • Testing and Development
  • Joomla Setup
  • Site Administration
  • Site Recovery
  • You have been hacked or defaced
-2

In order to upload pictures via administrator panel's media manager, I have to set images directory's chmod value to 774.

Then your hosting is poorly configured. You should get the hosting environment set up properly so that you don't need to use insecure permissions in the first place.

  • how can i override that "poor configuration"? – zkanoca Jan 12 '15 at 9:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.