Security of password protected Directories

[msnyder]

We're reasonably certain that someone "hacked into" a password protected directory of ours.[nbsp][nbsp]I say reasonably certain because it's hard to take some script-using wannabe hacker's claims seriously.

What he claimed was that any password protected directory with 755 or equivalent permissions set is an open invitation for people to waltz right in.[nbsp][nbsp]The claim is that the vulnerability has to do with the execute permissions on the directory.

Has anyone heard about this, is there any way to make these areas more secure?[nbsp][nbsp]Incidentally, if you take the execute privs off a directory, it can no longer be accessed at all (so that's not a viable option).

We haven't ruled anything out here, there's a chance that he just learned the password from a legitimate user.[nbsp][nbsp]I couldn't find any reference to this on the forums or FAQ, so I thought I'd toss it out here.[nbsp][nbsp]I noticed one person on this forum mentioned that password protected directories aren't really secure (but he didn't mention why).

[Terra]

With our setup, it would be difficult - unless:

1) You had the password file somewhere within the 'www/' directory tree...
**store password files in an 'xdom' directory: e.g. xdom/private**
2) They cannot read your '.htaccess' file directly, so it would be hard to determine the exact name of the password file...
2a)unless they had access to your account password - then login via Telnet/FTP/SSH is arbitrary and they can do pretty much anything they want to your account
2b)Keep your password safe and secure - I would recommend changing it ASAP just to be safe

Even if they did not accomplish (2a), and they were able to snag your 'web' password file - they still have to run a password cracker against the crypt() password...[nbsp][nbsp]If you chose a difficult password (alpha-numeric upperLower case) then it would escalate to brute force attack - instead of simple dictionary attack....

I've already made a post of links that may help you here:
http://www.aota.net/ubb/Forum3/HTML/001326-1.html

Hope this helps...

--
Terra
--Honey, did you lock the door?--
FutureQuest

[msnyder]

I checked on those things, we are certain that our account password hasn't been compromised.[nbsp][nbsp]That password is only known by two people and is changed frequently.

The password file is likewise in location you mention.

The claim here, is that the "hacker" somehow took advantage of the execute permission on the index file to circumvent the password protection entirely.

I wish I had more information to share.[nbsp][nbsp]All that I know for certain is that the wrong person got access to some files, and they've made the above claims about how they did it.[nbsp][nbsp]We've since shut down that part of our website entirely while we try to figure out what happened.

Thanks for the fast response.

- Martin