@GreyWolf What I mean is if he can upload a PHP file he can affect all files on the server for his account (all sites). This can happen with properly secured servers. Hostgator from what I know, just as any other CPanel host uses su-php or something similar. That restricts user1 from affecting files of user2. However, permissions of user1 are on his entire directory. There is one main site that's associated with the hosting account and the others are addon domains. That means the structure is something like:
Code:
/public_html/ <- files for main site
/public_html/addon1/ <- files for addon site #1
/public_html/addon2/
...
That means if he uploads a PHP file at /public_html/addon1/malicious.php then from that script he can affect all files under / directory. If the server allows exec() to run he could do even much worse.
Yeah thats a good point madoctopus. Depending on how the additional domains are structured under the user account would make a big difference.
If the additional domains are all under a single user account then every domain under the same user account would be compromised. If you're setting up addon domains with CPanel then it's about the same as creating subdomains, but with their own unique domain name. When you set up an addon domain in CPanel it actually explains that, so I kind of made an assumption that people know that. I probably shouldn't assume such things, so you're right to point that out. A domain set up as an addon is actually just a folder under the main domain's account. So yeah a malicious code on any of those folders could affect any other folder on that same account.
I've never bothered with setting up addon domains because I've always had reseller accounts. On reseller accounts you use the web host manager (WHM) to set up the domain and each domain gets it's own user account. That's one of the reasons I've always gone with reseller accounts even though I just set up my own domains on them. The client accounts are set up under the reseller account, but they all have their own user account. Same thing goes for VPS or DS, it's better to use the WHM or equivalent to set up seperate user accounts for each domain rather than setting up addon domains.
That's also what I meant about the vulnerabily being downward rather than upward. I was talking in terms of user accounts. If a client account is compromised then any folder on that user account is accessable, but there's very little risk to the master account or any other client accounts. If the client account is a reseller account also then any thing under the client account is at risk as well. If the reseller account is compromised then every client account under it can be compromised. Even though the accounts are set up with WHM, the client accounts can still be accessed and managed through the master account CPanel. I don't know if an uploaded script could access the client accounts, but a hacker with password access to the reseller account would definately have access to the them.
Unless there's a
serious misconfiguration it would be
extremely difficult for user1 or user2 to get access to the other accounts. Of course, I would never say never and there's also a lot more that an actual hacker that gained direct access to an account can do than what can be done with just a malicious script. If someone really is good enough, has enough time, and can find enough vulnerabilities they can eventually do just about anything they want.
Regardless of what someone can or can't accomplish though, the main thing is to do whatever you can to prevent it. Whenever someone does get attacked they need to deal with the problem quickly, proactively, and aggressively because the bad guys won't waste any time once they get access. :cool2:
edit-
The ones that do that stuff are just a bunch of scum anyway. They're the reason hacking got such a bad name. Thanks to the media, when people hear about a hacker they always think of account crackers, malware creators, and other evildoers. :irked:
Most of the real innovation in the computer industry has always been from hackers writing code that pushes hardware past the limits of it's design specs. That's who created the first computer games, built the first hobby computers, created the first modems, video display controllers, etc. Steve Wozniak was even considered a hacker. Basically a hacker is someone that can design hardware or code software with the inspiration of an artist rather than just follows instructions on how things should be done. They're the innovators in the computer field. But that's not who the average person thinks of when they hear the term anymore.
:call2:
