UBB.Developers Forums Community Development Promoting Your Community Forum Showcase Security

Is there anyone here who would be considered an expert on the issue of board security? IE. preventing mischief makers from getting into files and forums that they shouldn't be getting in to. I really could use some help in this area. Thank you...

Is this your server or a hosting companies? You will need to note what version of UBB, operating system as well as the modules you are running. Also are you completly patched? Just for starters...

First thing to be safe: Turn off HTML in forums.

I had forgotten about that. I did have it on in the one forum. Can you explain how that works? How does having HTML on in a forum create a security leak?

I'll be honest here... My mind does not run this way so it is difficult at best for me to put up defenses. I have no interest in being destructive to others' boards so I have no idea how it is done to mine.

Perhaps some simple lessons here might help others as well.

Thank you LD...

Imaginative use of HTML can do tricky things, such as running scripts and stealing other people's cookies. There are filters in UBB which attempt to prevent this type of abuse, but new exploits continue to be found. The safest approach is to disable HTML posting, and only allow UBB Code.

UBB Code images pose a similar threat.

Other security tips:

1) Ensure that your server is configured so that certain files cannot be accessed from a web browser, such as member profiles, cache files and the vars_ configuration files. You can test for this by trying to access the files yourself from a browser.

2) If possible, move your members directory outside of the web document tree.

3) Protect directories that shouldn't be accessed from a web browser with .htaccess files.

4) Password-protect the control panel with an .htaccess file.

Searching for "security", "members" and "htaccess" in these forums or the Infopop community forums should provide more details on the above.

Well, even though HTML is filtered, it is far easier to feed 'bad' scripts to the page via it.

Most importantly, change all your Admin passwords and FTP passwords frequently. Use completely different passwords for each. Use passwords that contain numbers and letters and avoid names and words that can be found in a dictionary. In other words: random strings of letters and numbers.

Dave you don't need to use .htaccess files to stop that. All you need to do is upload a blank index.html file and they can't access it from a browser.

That is not correct.

A blank index.html file will prevent the browser from displaying a directory listing, but it won't stop the browser from accessing a file within that directory, if the user knows the file name.

I guess you made your point.

Should start using .htaccess now.

assuming she is using apache. . . . . . . . .. . . . . . . . . . . .. . . . . . . .. . ..

Yes, Apache... PowWeb.

Can't find my httpd.conf file though!...