Security fix for Frag Frog package

IMPORTANT SECURITY FIX FROGMU WEBPACKAGE

I recently discovered that a default Appserv installation DOES NOT protect your config.htpasswd file. This means that any smart hacker can get your username and password! I tested it myself and easily got the SQL server login username and password for someone's private server!

HOW TO FIX
quite easy, luckily. Open your Appserv configuration files. You can do this by either going to your start menu -> Programs -> Appserv -> Apache Configure Server -> Edit the httpd.conf Configuration file. Another way of opening it is going to your webserver folder (probably in c:\program files\appserv\), apache -> conf -> httpd.conf

You can open this file using a text-editor as notepad

Now, find the line that says

Code:

---

# Also, folks tend to use nameas such as .htpasswd for their password
# files, so this will protect those as well.
#

---

This should be around line 407.

Below these lines you will find something like '<files ~"^/.ht"> stuff here </files>

REPLACE THAT WITH

Code:

---

<Files *.ht*>
Deny From All
</Files>

---

Now, save the file and restart apache (using the Apache service monitor, or trough your start menu -> programs -> appserv -> Apache Control Server -> Restart)

Applies To:
FrogMu Webpackage 2.0 beta


How to test this:
I dare not publish here how you can test it since scriptkiddo's will probably abuse it, if you're not 100% sure its secure PM me and I'll test it for you.

thanks frag frog :P

Nice one! Keep the good job!

Thanks man !! you are really something !!

Keep the VERY good job !!!
You are wonderful !

rofl i was just looking for this :>

all those intruction or u can put this inside ur config.htpasswd

Quote:

---

if (stristr($_SERVER['PHP_SELF'], "config.htpasswd") AND stristr($_SERVER['SCRIPT_NAME'], "config.htpasswd")) { die ("Access Denied kiddies!!!"); **

---

-- note: cant remember if it is config.htpasswd .. just replace that with ur config filename
remember to put below the <?

where abouts? lol this sounds so dumb!

I founded this one ;)

Quote:

---

Originally Posted by john_d

all those intruction or u can put this inside ur config.htpasswd
-- note: cant remember if it is config.htpasswd .. just replace that with ur config filename
remember to put below the <?

---

Thats an option too ofcourse, but if they host anything else on their server thats prolly insecure as well - default Appserv install lets anyone see folder contents and download any file it doesn't recognise. Better secure your apache then secure every folder you have ;)

http://fragfrog.mine.nu/MuOnline/
The page cannot be displayed
The page you are looking for is currently unavailable. The Web site might be experiencing technical difficulties, or you may need to adjust your browser settings.


you no have server muonline ?
only like make the page for all ppl on ragezone ? :)
sorry for my english :)

nice job thnx for the fix

Insider , read ur PM

Frog Best of the best web template :)