headers
tom-bGWuzas0w7A@public.gmane.org | 1 Nov 15:14
Picon

big problems with spip site ( hackers attacking)

Im having major problems with a spip site.
Therefore a few quistions...

Can hackers write something ino the database that gives them "acces"  
to the folder on my ISP area ( where I place the site, in this case / 
mir.dk)

Im having a problem, with urls.. ( even after full reinstall ) ( with  
the same database)
If the urls are the "normal way" ( spip.php?articleXXXX) there are no  
problems, if I try with "propre" ( spip.php?article-name-) I get  
redirected ( turned of the feature right after i saw I got redirected) 
( they redirect me to mir2.dk) ( another of my sites, in the same  
"folder" in my ISP area ( sister site)

The hackers attacked the site, and all other (sister) sites, last  
saturday, and came back this saturday, again with a phizing folder.  
( last week they placed 25 folders)
Its deleted now, but I think they will try again and again..

Any ideas to make the SPIP folder(s) more "safe".
Can I as an exsample change some "rights" to write in the folder and  
can I change some rights ( chmod etc) in the sub folders. ( do I need  
777 chmod to local, IMG and other folders, or is 644 OK !?) ( does it  
matter)

Since I think they have been doing something to my database, how do I  
make a new one, and still keep the +4000 articles..
I have php my admin, but dont know how to use it for this purpose
(Continue reading)

Permalink | Reply | 6 comments |
headers
Gilles VINCENT | 2 Nov 15:54
Picon
Gravatar

Re: big problems with spip site ( hackers attacking)

Hi,

On Sat, Nov 1, 2008 at 3:14 PM, tom-bGWuzas0w7A@public.gmane.org <tom-bGWuzas0w7A@public.gmane.org> wrote:
Im having major problems with a spip site.
Therefore a few quistions...

Can hackers write something ino the database that gives them "acces" to the folder on my ISP area ( where I place the site, in this case /mir.dk)
No, I don't think so.
The only serious problem like yours that was reported until now wasn't due to SPIP, but to a problem of the web hosting service.
 
Im having a problem, with urls.. ( even after full reinstall ) ( with the same database)
If the urls are the "normal way" ( spip.php?articleXXXX) there are no problems, if I try with "propre" ( spip.php?article-name-) I get redirected ( turned of the feature right after i saw I got redirected)( they redirect me to mir2.dk) ( another of my sites, in the same "folder" in my ISP area ( sister site)
This looks like a problem to .htaccess
Can you check that you do not indicate any "mir2.dk" inside it ?
Because it's still your website, I think that it's a pb of configuration, not an attack.
 
The hackers attacked the site, and all other (sister) sites, last saturday, and came back this saturday, again with a phizing folder. ( last week they placed 25 folders)
Its deleted now, but I think they will try again and again..
Do you have an access to the Apache logs ?
Is it a dedicated or a shared hosting ?
The first thing that I would do is changing every passwords : ftp / ssh / mySQL / manager
And of course Never keep the same password for each access. A simple tips is to pre- and post-fix your passwords with the name of the concerned process : ftMyPasswordp / ssMyPasswordh / myMyPasswordS / maMyPasswordn - Find something that is still easy to remember :)
 
Any ideas to make the SPIP folder(s) more "safe".
Can I as an exsample change some "rights" to write in the folder and can I change some rights ( chmod etc) in the sub folders. ( do I need 777 chmod to local, IMG and other folders, or is 644 OK !?) ( does it matter)
You don't have to use 777 mode.
The only directories that have to be writable for apache are IMG/ tmp/ and local/
What I personnaly do is to chown these directories to the apache user : 
chown -R apache:apache IMG/* tmp/* local/*
and chmod -R og-rw IMG/* tmp/* local/*
 

Since I think they have been doing something to my database, how do I make a new one, and still keep the +4000 articles..
I have php my admin, but dont know how to use it for this purpose
To dump / import properly, you can do like this : 
A/ export the database with phpMyAdmin. Uncheck the options "Extended inserts" and "Complete inserts" (it's for the import step)
B/ create a new database
C/ import your dump with phpMyAdmin. Sometimes, your dump file is to huge to be correctly imported by pMA. So I prefer using bigdump.php (available here : http://www.ozerov.de/bigdump.php -- it's really well documented)
D/ install SPIP whith these new database
You can parse your dump to see if you find anything strange. For exemple, an admin user that you haven't created.. But imho, I doubt that you find anything : you seems to be the victim of a root kit.
If you are not on a shared hosting, you can create a mysql user who will only be able to see a specific database (you can even restrict it's access right to some tables !).
 

PS
Anybody know any software telling you by mail, if any new folders/files has been installed on your apache server..( maybe this could help me solve the problem..)
______________________________
Yes : such systems exist - They are IDS (Intrusion Detection System) :
gives an explanation and a list of free softwares
 
.Gilles
---
_________________
spip-en-JM9gtpQu/Ho@public.gmane.org - http://listes.rezo.net/mailman/listinfo/spip-en

Permalink | Reply | 5 comments |
headers
kamran Mir Hazar | 3 Nov 04:12
Picon
Favicon

error

Hello,
I gave an error for several times. The translation of the error is like this: Cannot connect to database because of a technical problem. I have checked the database, repaired the tables via PHP my admin and SPIP Cpanel. I have also re-established the connection to the database, but still I'm giving that error for sometime.
Any idea?
All the best
Kamran

From: Gil les VINCENT <gilles.vincent-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: "tom-bGWuzas0w7A@public.gmane.org" <tom-bGWuzas0w7A@public.gmane.org>
Cc: spip-en spip-en <spip-en-JM9gtpQu/Ho@public.gmane.org>
Sent: Sunday, November 2, 2008 3:54:41 PM
Subject: Re: [Spip-en] big problems with spip site ( hackers attacking)

Hi,

On Sat, Nov 1, 2008 at 3:14 PM, tom-bGWuzas0w7A@public.gmane.org <tom-bGWuzas0w7A@public.gmane.org> wrote:
Im having major problems with a spip site.
Therefore a few quistions...

Can hackers write something ino the database that gives them "acces" to the folder on my ISP area ( where I place the site, in this case /mir.dk)
No, I don't think so.
The only serious problem like yours that was reported until now wasn't due to SPIP, but to a problem of the web hosting service.
 
Im having a problem, with urls.. ( even after full reinstall ) ( with the same database)
If the urls are the "normal way" ( spip.php?articleXXXX) there are no problems, if I try with "propre" ( spip.php?article-name-) I get redirected ( turned of the feature right after i saw I got redirected)( they redirect me to mir2.dk) ( another of my sites, in the same "folder" in my ISP area ( sister site)
This looks like a problem to .htaccess
Can you check that you do not indicate any "mir2.dk" inside it ?
Because it's still your website, I think that it's a pb of configuration, not an attack.
 
The hackers attacked the site, and all other (sister) sites, last saturday, and came back this saturday, again with a phizing folder. ( last week they placed 25 folders)
Its deleted now, but I think they will try again and again..
Do you have an access to the Apache logs ?
Is it a dedicated or a shared hosting ?
The first thing that I would do is changing every passwords : ftp / ssh / mySQL / manager
And of course Never keep the same password for each access. A simple tips is to pre- and post-fix your passwords with the name of the concerned process : ftMyPasswordp / ssMyPasswordh / myMyPasswordS / maMyPasswordn - Find something that is still easy to remember :)
 
Any ideas to make the SPIP folder(s) more "safe".
Can I as an exsample change some "rights" to write in the folder and can I change some rights ( chmod etc) in the sub folders. ( do I need 777 chmod to local, IMG and other folders, or is 644 OK !?) ( does it matter)
You don't have to use 777 mode.
The only directories that have to be writable for apache are IMG/ tmp/ and local/
What I personnaly do is to chown these directories to the apache user : 
chown -R apache:apache IMG/* tmp/* local/*
and chmod -R og-rw IMG/* tmp/* local/*
 

Since I think they have been doing something to my database, how do I make a new one, and still keep the +4000 articles..
I have php my admin, but dont know how to use it for this purpose
To dump / import properly, you can do like this : 
A/ export the database with phpMyAdmin. Uncheck the options "Extended inserts" and "Complete inserts" (it's for the import step)
B/ create a new database
C/ import your dump with phpMyAdmin. Sometimes, your dump file is to huge to be correctly imported by pMA. So I prefer using bigdump.php (available here : http://www.ozerov.de/bigdump.php -- it's really well documented)
D/ install SPIP whith these new database
You can parse your dump to see if you find anything strange. For exemple, an admin user that you haven't created.. But imho, I doubt that you find anything : you seems to be the victim of a root kit.
If you are not on a shared hosting, you can create a mysql user who will only be able to see a specific database (you can even restrict it's access right to some tables !).
 

PS
Anybody know any software telling you by mail, if any new folders/files has been installed on your apache server..( maybe this could help me solve the problem..)
______________________________
Yes : such systems exist - They are IDS (Intrusion Detection System) :
gives an explanation and a list of free softwares
 
.Gilles
---
_________________
spip-en-JM9gtpQu/Ho@public.gmane.org - http://listes.rezo.net/mailman/listinfo/spip-en

Permalink | Reply | 4 comments |
headers
Gilles VINCENT | 3 Nov 05:23
Picon
Gravatar

Re: error

Hi, 


does this error occurs with a fresh install of SPIP, or during an upgrade ?
Sometimes, when you upgrade from an old 1.8.3 version, you forget the file ecrire/inc_connect.php3 which overwrites config/connect.php (in fact it's the same if inc_connect.php3 still exists at the root directory). 

.Gilles
---

On Mon, Nov 3, 2008 at 4:12 AM, kamran Mir Hazar <kamran_mirhazar-/E1597aS9LQAvxtiuMwx3w@public.gmane.org> wrote:
Hello,
I gave an error for several times. The translation of the error is like this: Cannot connect to database because of a technical problem. I have checked the database, repaired the tables via PHP my admin and SPIP Cpanel. I have also re-established the connection to the database, but still I'm giving that error for sometime.
Any idea?
All the best
Kamran

From: Gilles VINCENT <gilles.vincent-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: "tom-bGWuzas0w7A@public.gmane.org" <tom-bGWuzas0w7A@public.gmane.org>
Cc: spip-en spip-en <spip-en-JM9gtpQu/Ho@public.gmane.org>
Sent: Sunday, November 2, 2008 3:54:41 PM
Subject: Re: [Spip-en] big problems with spip site ( hackers attacking)

Hi,

On Sat, Nov 1, 2008 at 3:14 PM, tom-bGWuzas0w7A@public.gmane.org <tom-bGWuzas0w7A@public.gmane.org> wrote:
Im having major problems with a spip site.
Therefore a few quistions...

Can hackers write something ino the database that gives them "acces" to the folder on my ISP area ( where I place the site, in this case /mir.dk)
No, I don't think so.
The only serious problem like yours that was reported until now wasn't due to SPIP, but to a problem of the web hosting service.
 
Im having a problem, with urls.. ( even after full reinstall ) ( with the same database)
If the urls are the "normal way" ( spip.php?articleXXXX) there are no problems, if I try with "propre" ( spip.php?article-name-) I get redirected ( turned of the feature right after i saw I got redirected)( they redirect me to mir2.dk) ( another of my sites, in the same "folder" in my ISP area ( sister site)
This looks like a problem to .htaccess
Can you check that you do not indicate any "mir2.dk" inside it ?
Because it's still your website, I think that it's a pb of configuration, not an attack.
 
The hackers attacked the site, and all other (sister) sites, last saturday, and came back this saturday, again with a phizing folder. ( last week they placed 25 folders)
Its deleted now, but I think they will try again and again..
Do you have an access to the Apache logs ?
Is it a dedicated or a shared hosting ?
The first thing that I would do is changing every passwords : ftp / ssh / mySQL / manager
And of course Never keep the same password for each access. A simple tips is to pre- and post-fix your passwords with the name of the concerned process : ftMyPasswordp / ssMyPasswordh / myMyPasswordS / maMyPasswordn - Find something that is still easy to remember :)
 
Any ideas to make the SPIP folder(s) more "safe".
Can I as an exsample change some "rights" to write in the folder and can I change some rights ( chmod etc) in the sub folders. ( do I need 777 chmod to local, IMG and other folders, or is 644 OK !?) ( does it matter)
You don't have to use 777 mode.
The only directories that have to be writable for apache are IMG/ tmp/ and local/
What I personnaly do is to chown these directories to the apache user : 
chown -R apache:apache IMG/* tmp/* local/*
and chmod -R og-rw IMG/* tmp/* local/*
 

Since I think they have been doing something to my database, how do I make a new one, and still keep the +4000 articles..
I have php my admin, but dont know how to use it for this purpose
To dump / import properly, you can do like this : 
A/ export the database with phpMyAdmin. Uncheck the options "Extended inserts" and "Complete inserts" (it's for the import step)
B/ create a new database
C/ import your dump with phpMyAdmin. Sometimes, your dump file is to huge to be correctly imported by pMA. So I prefer using bigdump.php (available here : http://www.ozerov.de/bigdump.php -- it's really well documented)
D/ install SPIP whith these new database
You can parse your dump to see if you find anything strange. For exemple, an admin user that you haven't created.. But imho, I doubt that you find anything : you seems to be the victim of a root kit.
If you are not on a shared hosting, you can create a mysql user who will only be able to see a specific database (you can even restrict it's access right to some tables !).
 

PS
Anybody know any software telling you by mail, if any new folders/files has been installed on your apache server..( maybe this could help me solve the problem..)
______________________________
Yes : such systems exist - They are IDS (Intrusion Detection System) :
gives an explanation and a list of free softwares
 
.Gilles
---
_________________
spip-en-JM9gtpQu/Ho@public.gmane.org - http://listes.rezo.net/mailman/listinfo/spip-en


_______________________________________________
spip-en-JM9gtpQu/Ho@public.gmane.org - http://listes.rezo.net/mailman/listinfo/spip-en


Permalink | Reply | 3 comments |
headers
kamran Mir Hazar | 3 Nov 08:06
Picon
Favicon

Re: error

Hi Gilles,
I upgraded from SPIP 1.9.2d to SPIP 1.9.2e when it has launched.  I gave error when I was validating messages. One of the users says he gave the same error when he was submitting a new article.
Regards
Kamran
 



From: Gilles VINCENT <gilles.vincent-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: kamran Mir Hazar <editor-KuNTkyfR4oyXFJAUJl40Xg@public.gmane.org>
Cc: spip-en spip-en <spip-en-JM9gtpQu/Ho@public.gmane.org>
Sent: Monday, November 3, 2008 5:23:21 AM
Subject: Re: [Spip-en] error

Hi, 

does this error occurs with a fresh install of SPIP, or during an upgrade ?
Sometimes, when you upgrade from an old 1.8.3 version, you forget the file ecrire/inc_connect.php3 which overwrites config/connect.php (in fact it's the same if inc_connect.php3 still exists at the root directory). 

.Gilles
---

On Mon, Nov 3, 2008 at 4:12 AM, kamran Mir Hazar <kamran_mirhazar-/E1597aS9LQAvxtiuMwx3w@public.gmane.org> wrote:
Hello,
I gave an error for several times. The translation of the error is like this: Cannot connect to database because of a technical problem. I have checked the database, repaired the tables via PHP my admin and SPIP Cpanel. I have also re-established the connection to the database, but still I'm giving that error for sometime.
Any idea?
All the best
Kamran

From: Gilles VINCENT <gilles.vincent-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: "tom-bGWuzas0w7A@public.gmane.org" <tom-bGWuzas0w7A@public.gmane.org>
Cc: spip-en spip-en <spip-en-JM9gtpQu/Ho@public.gmane.org>
Sent: Sunday, November 2, 2008 3:54:41 PM
Subject: Re: [Spip-en] big problems with spip site ( hackers attacking)

Hi,

On Sat, Nov 1, 2008 at 3:14 PM, tom-bGWuzas0w7A@public.gmane.org <tom-bGWuzas0w7A@public.gmane.org> wrote:
Im having major problems with a spip site.
Therefore a few quistions...

Can hackers write something ino the database that gives them "acces" to the folder on my ISP area ( where I place the site, in this case /mir.dk)
No, I don't think so.
The only serious problem like yours that was reported until now wasn't due to SPIP, but to a problem of the web hosting service.
 
Im having a problem, with urls.. ( even after full reinstall ) ( with the same database)
If the urls are the "normal way" ( spip.php?articleXXXX) there are no problems, if I try with "propre" ( spip.php?article-name-) I get redirected ( turned of the feature right after i saw I got redirected)( they redirect me to mir2.dk) ( another of my sites, in the same "folder" in my ISP area ( sister site)
This looks like a problem to .htaccess
Can you check that you do not indicate any "mir2.dk" inside it ?
Because it's still your website, I think that it's a pb of configuration, not an attack.
 
The hackers attacked the site, and all other (sister) sites, last saturday, and came back this saturday, again with a phizing folder. ( last week they placed 25 folders)
Its deleted now, but I think they will try again and again..
Do you have an access to the Apache logs ?
Is it a dedicated or a shared hosting ?
The first thing that I would do is changing every passwords : ftp / ssh / mySQL / manager
And of course Never keep the same password for each access. A simple tips is to pre- and post-fix your passwords with the name of the concerned process : ftMyPasswordp / ssMyPasswordh / myMyPasswordS / maMyPasswordn - Find something that is still easy to remember :)
 
Any ideas to make the SPIP folder(s) more "safe".
Can I as an exsample change some "rights" to write in the folder and can I change some rights ( chmod etc) in the sub folders. ( do I need 777 chmod to local, IMG and other folders, or is 644 OK !?) ( does it matter)
You don't have to use 777 mode.
The only directories that have to be writable for apache are IMG/ tmp/ and local/
What I personnaly do is to chown these directories to the apache user : 
chown -R apache:apache IMG/* tmp/* local/*
and chmod -R og-rw IMG/* tmp/* local/*
 

Since I think they have been doing something to my database, how do I make a new one, and still keep the +4000 articles..
I have php my admin, but dont know how to use it for this purpose
To dump / import properly, you can do like this : 
A/ export the database with phpMyAdmin. Uncheck the options "Extended inserts" and "Complete inserts" (it's for the import step)
B/ create a new database
C/ import your dump with phpMyAdmin. Sometimes, your dump file is to huge to be correctly imported by pMA. So I prefer using bigdump.php (available here : http://www.ozerov.de/bigdump.php -- it's really well documented)
D/ install SPIP whith these new database
You can parse your dump to see if you find anything strange. For exemple, an admin user that you haven't created.. But imho, I doubt that you find anything : you seems to be the victim of a root kit.
If you are not on a shared hosting, you can create a mysql user who will only be able to see a specific database (you can even restrict it's access right to some tables !).
 

PS
Anybody know any software telling you by mail, if any new folders/files has been installed on your apache server..( maybe this could help me solve the problem..)
______________________________
Yes : such systems exist - They are IDS (Intrusion Detection System) :
gives an explanation and a list of free softwares
 
.Gilles
---
_________________
spip-en-JM9gtpQu/Ho@public.gmane.org - http://listes.rezo.net/mailman/listinfo/spip-en


_______________________________________________
spip-en-JM9gtpQu/Ho@public.gmane.org - http://listes.rezo.net/mailman/listinfo/spip-en


Permalink | Reply | 2 comments |
headers
Gilles VINCENT | 3 Nov 12:12
Picon
Gravatar

Re: error

Hi,

I suggest you to upgrade your version of SPIP1.9.2e : in fact, this version is still in development, and benefits of minor corrections (the last change was made 8 days ago)

You can find it here :
http://files.spip.org/spip/

The changelog of the branch 1.9.2 can be found here :
http://trac.rezo.net/trac/spip/log/branches/spip-1.9.2

Also check that you don't use plugins : maybe they have to be updated too. And they can be at the origin of your problems (it is well known that frogies are intelligents, but not so much -- http://www.frogsite.org/Frog.html ;-)

As you are already on a 1.9.2 version, your database won't be changed. So I'm convinced that this upgrade is riskless (but you can still backup you database and your directory, he :-)


.Gilles
---

On Mon, Nov 3, 2008 at 8:06 AM, kamran Mir Hazar <kamran_mirhazar-/E1597aS9LQAvxtiuMwx3w@public.gmane.org> wrote:
Hi Gilles,
I upgraded from SPIP 1.9.2d to SPIP 1.9.2e when it has launched.  I gave error when I was validating messages. One of the users says he gave the same error when he was submitting a new article.
Regards
Kamran
 



From: Gilles VINCENT <gilles.vincent-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: kamran Mir Hazar <editor-KuNTkyfR4oyXFJAUJl40Xg@public.gmane.org>
Cc: spip-en spip-en <spip-en-JM9gtpQu/Ho@public.gmane.org>
Sent: Monday, November 3, 2008 5:23:21 AM
Subject: Re: [Spip-en] error

Hi, 

does this error occurs with a fresh install of SPIP, or during an upgrade ?
Sometimes, when you upgrade from an old 1.8.3 version, you forget the file ecrire/inc_connect.php3 which overwrites config/connect.php (in fact it's the same if inc_connect.php3 still exists at the root directory). 

.Gilles
---

On Mon, Nov 3, 2008 at 4:12 AM, kamran Mir Hazar <kamran_mirhazar-/E1597aS9LQAvxtiuMwx3w@public.gmane.org> wrote:
Hello,
I gave an error for several times. The translation of the error is like this: Cannot connect to database because of a technical problem. I have checked the database, repaired the tables via PHP my admin and SPIP Cpanel. I have also re-established the connection to the database, but still I'm giving that error for sometime.
Any idea?
All the best
Kamran

From: Gilles VINCENT <gilles.vincent-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: "tom-bGWuzas0w7A@public.gmane.org" <tom-bGWuzas0w7A@public.gmane.org>
Cc: spip-en spip-en <spip-en-JM9gtpQu/Ho@public.gmane.org>
Sent: Sunday, November 2, 2008 3:54:41 PM
Subject: Re: [Spip-en] big problems with spip site ( hackers attacking)

Hi,

On Sat, Nov 1, 2008 at 3:14 PM, tom-bGWuzas0w7A@public.gmane.org <tom-bGWuzas0w7A@public.gmane.org> wrote:
Im having major problems with a spip site.
Therefore a few quistions...

Can hackers write something ino the database that gives them "acces" to the folder on my ISP area ( where I place the site, in this case /mir.dk)
No, I don't think so.
The only serious problem like yours that was reported until now wasn't due to SPIP, but to a problem of the web hosting service.
 
Im having a problem, with urls.. ( even after full reinstall ) ( with the same database)
If the urls are the "normal way" ( spip.php?articleXXXX) there are no problems, if I try with "propre" ( spip.php?article-name-) I get redirected ( turned of the feature right after i saw I got redirected)( they redirect me to mir2.dk) ( another of my sites, in the same "folder" in my ISP area ( sister site)
This looks like a problem to .htaccess
Can you check that you do not indicate any "mir2.dk" inside it ?
Because it's still your website, I think that it's a pb of configuration, not an attack.
 
The hackers attacked the site, and all other (sister) sites, last saturday, and came back this saturday, again with a phizing folder. ( last week they placed 25 folders)
Its deleted now, but I think they will try again and again..
Do you have an access to the Apache logs ?
Is it a dedicated or a shared hosting ?
The first thing that I would do is changing every passwords : ftp / ssh / mySQL / manager
And of course Never keep the same password for each access. A simple tips is to pre- and post-fix your passwords with the name of the concerned process : ftMyPasswordp / ssMyPasswordh / myMyPasswordS / maMyPasswordn - Find something that is still easy to remember :)
 
Any ideas to make the SPIP folder(s) more "safe".
Can I as an exsample change some "rights" to write in the folder and can I change some rights ( chmod etc) in the sub folders. ( do I need 777 chmod to local, IMG and other folders, or is 644 OK !?) ( does it matter)
You don't have to use 777 mode.
The only directories that have to be writable for apache are IMG/ tmp/ and local/
What I personnaly do is to chown these directories to the apache user : 
chown -R apache:apache IMG/* tmp/* local/*
and chmod -R og-rw IMG/* tmp/* local/*
 

Since I think they have been doing something to my database, how do I make a new one, and still keep the +4000 articles..
I have php my admin, but dont know how to use it for this purpose
To dump / import properly, you can do like this : 
A/ export the database with phpMyAdmin. Uncheck the options "Extended inserts" and "Complete inserts" (it's for the import step)
B/ create a new database
C/ import your dump with phpMyAdmin. Sometimes, your dump file is to huge to be correctly imported by pMA. So I prefer using bigdump.php (available here : http://www.ozerov.de/bigdump.php -- it's really well documented)
D/ install SPIP whith these new database
You can parse your dump to see if you find anything strange. For exemple, an admin user that you haven't created.. But imho, I doubt that you find anything : you seems to be the victim of a root kit.
If you are not on a shared hosting, you can create a mysql user who will only be able to see a specific database (you can even restrict it's access right to some tables !).
 

PS
Anybody know any software telling you by mail, if any new folders/files has been installed on your apache server..( maybe this could help me solve the problem..)
______________________________
Yes : such systems exist - They are IDS (Intrusion Detection System) :
gives an explanation and a list of free softwares
 
.Gilles
---
_________________
spip-en-JM9gtpQu/Ho@public.gmane.org - http://listes.rezo.net/mailman/listinfo/spip-en


_______________________________________________
spip-en-JM9gtpQu/Ho@public.gmane.org - http://listes.rezo.net/mailman/listinfo/spip-en



Permalink | Reply | 1 comment |
headers
kamran Mir Hazar | 3 Nov 16:11
Picon
Favicon

Re: error

Dear Gilles,
Thank you.
I'll do that.
Kamran
 



From: Gilles VINCENT <gilles.vincent-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: kamran Mir Hazar <editor-KuNTkyfR4oyXFJAUJl40Xg@public.gmane.org&g t;
Cc: spip-en spip-en <spip-en-JM9gtpQu/Ho@public.gmane.org>
Sent: Monday, November 3, 2008 12:12:34 PM
Subject: Re: [Spip-en] error

Hi,

I suggest you to upgrade your version of SPIP1.9.2e : in fact, this version is still in development, and benefits of minor corrections (the last change was made 8 days ago)

You can find it here :
http://files.spip.org/spip/

The changelog of the branch 1.9.2 can be found here :
http://trac.rezo.net/trac/spip/log/branches/spip-1.9.2

Also check that you don't use plugins : maybe they have to be updated too. And they can be at the origin of your problems (it is well known that frogies are intelligents, but not so much -- http://www.frogsite.org/Frog.html ;-)

As you are already on a 1.9.2 version, your database won't be changed. So I'm convinced that this upgrade is riskless (but you can still backup you database and your directory, he :-)


.Gilles
---
On Mon, Nov 3, 2008 at 8:06 AM, kamran Mir Hazar <kamran_mirhazar-/E1597aS9LQAvxtiuMwx3w@public.gmane.org> wrote:
Hi Gilles,
I upgraded from SPIP 1.9.2d to SPIP 1.9.2e when it has launched.  I gave error when I was validating messages. One of the users says he gave the same error when he was submitting a new article.
Regards
Kamran
 



From: Gilles VINCENT <gilles.vincent-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: kamran Mir Hazar <editor-KuNTkyfR4oyXFJAUJl40Xg@public.gmane.org>
Cc: spip-en spip-en <spip-en-JM9gtpQu/Ho@public.gmane.org>
Sent: Monday, November 3, 2008 5:23:21 AM
Subject: Re: [Spip-en] error

Hi, 

does this error occurs with a fresh install of SPIP, or during an upgrade ?
Sometimes, when you upgrade from an old 1.8.3 version, you forget the file ecrire/inc_connect.php3 which overwrites config/connect.php (in fact it's the same if inc_connect.php3 still exists at the root directory). 

.Gilles
---

On Mon, Nov 3, 2008 at 4:12 AM, kamran Mir Hazar <kamran_mirhazar-/E1597aS9LQAvxtiuMwx3w@public.gmane.org> wrote:
Hello,
I gave an error for several times. The translation of the error is like this: Cannot connect to database because of a technical problem. I have checked the database, repaired the tables via PHP my admin and SPIP Cpanel. I have also re-established the connection to the database, but still I'm giving that error for sometime.
Any idea?
All the best
Kamran

From: Gilles VINCENT <gilles.vincent-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: "tom-bGWuzas0w7A@public.gmane.org" <tom-bGWuzas0w7A@public.gmane.org>
Cc: spip-en spip-en <spip-en-JM9gtpQu/Ho@public.gmane.org>
Sent: Sunday, November 2, 2008 3:54:41 PM
Subject: Re: [Spip-en] big problems with spip site ( hackers attacking)

Hi,

On Sat, Nov 1, 2008 at 3:14 PM, tom-bGWuzas0w7A@public.gmane.org <tom-bGWuzas0w7A@public.gmane.org> wrote:
Im having major problems with a spip site.
Therefore a few quistions...

Can hackers write something ino the database that gives them "acces" to the folder on my ISP area ( where I place the site, in this case /mir.dk)
No, I don't think so.
The only serious problem like yours that was reported until now wasn't due to SPIP, but to a problem of the web hosting service.
 
Im having a problem, with urls.. ( even after full reinstall ) ( with the same database)
If the urls are the "normal way" ( spip.php?articleXXXX) there are no problems, if I try with "propre" ( spip.php?article-name-) I get redirected ( turned of the feature right after i saw I got redirected)( they redirect me to mir2.dk) ( another of my sites, in the same "folder" in my ISP area ( sister site)
This looks like a problem to .htaccess
Can you check that you do not indicate any "mir2.dk" inside it ?
Because it's still your website, I think that it's a pb of configuration, not an attack.
 
The hackers attacked the site, and all other (sister) sites, last saturday, and came back this saturday, again with a phizing folder. ( last week they placed 25 folders)
Its deleted now, but I think they will try again and again..
Do you have an access to the Apache logs ?
Is it a dedicated or a shared hosting ?
The first thing that I would do is changing every passwords : ftp / ssh / mySQL / manager
And of course Never keep the same password for each access. A simple tips is to pre- and post-fix your passwords with the name of the concerned process : ftMyPasswordp / ssMyPasswordh / myMyPasswordS / maMyPasswordn - Find something that is still easy to remember :)
 
Any ideas to make the SPIP folder(s) more "safe".
Can I as an exsample change some "rights" to write in the folder and can I change some rights ( chmod etc) in the sub folders. ( do I need 777 chmod to local, IMG and other folders, or is 644 OK !?) ( does it matter)
You don't have to use 777 mode.
The only directories that have to be writable for apache are IMG/ tmp/ and local/
What I personnaly do is to chown these directories to the apache user : 
chown -R apache:apache IMG/* tmp/* local/*
and chmod -R og-rw IMG/* tmp/* local/*
 

Since I think they have been doing something to my database, how do I make a new one, and still keep the +4000 articles..
I have php my admin, but dont know how to use it for this purpose
To dump / import properly, you can do like this : 
A/ export the database with phpMyAdmin. Uncheck the options "Extended inserts" and "Complete inserts" (it's for the import step)
B/ create a new database
C/ import your dump with phpMyAdmin. Sometimes, your dump file is to huge to be correctly imported by pMA. So I prefer using bigdump.php (available here : http://www.ozerov.de/bigdump.php -- it's really well documented)
D/ install SPIP whith these new database
You can parse your dump to see if you find anything strange. For exemple, an admin user that you haven't created.. But imho, I doubt that you find anything : you seems to be the victim of a root kit.
If you are not on a shared hosting, you can create a mysql user who will only be able to see a specific database (you can even restrict it's access right to some tables !).
 

PS
Anybody know any software telling you by mail, if any new folders/files has been installed on your apache server..( maybe this could help me solve the problem..)
______________________________
Yes : such systems exist - They are IDS (Intrusion Detection System) :
gives an explanation and a list of free softwares
 
.Gilles
---
_________________
spip-en-JM9gtpQu/Ho@public.gmane.org - http://listes.rezo.net/mailman/listinfo/spip-en


_______________________________________________
spip-en-JM9gtpQu/Ho@public.gmane.org - http://listes.rezo.net/mailman/listinfo/spip-en



Permalink | Reply | 0 comments |
headers
tom-bGWuzas0w7A@public.gmane.org | 5 Nov 17:39
Picon

strange problem maybe its plugins maybe spipbb

I did do some layout on my spip site yesterday( spipBB style_forum_pub.css modifications), and an update on the Lang folder in spipBB ( that is only partly translated to my native language Danish)
I also turned on the plugins  needed for spipBB ( 0612 I think it is) to work

The strange thing that happened was that after i uploaded or just modified some files, my site went white..
spip.php loaded absolutely nothing ( really a fast site) ( unfortunately no content)
And there were no acces to /ecrire or ( it tried moving confic/connection ) 
reinstalled the install folder and anything else. ( tried site/install ( white page)( or got redirected to 
I have had - over the years - some problems with the tmp folder ( sometimes sessions sometimes other folders inside)
Used to move it all, and the site worked again...
This time, it was a "new thing" spip.php loaded nothing.. ( never seen that before)

Must telle that my site have been hacked ( maybe a root kit hack) ( they are still trying with password sniffers and other dotSOMETHINg files on my shared domain space ( four sites)
I keep changing passwords, and tried to download my entire DB to see if it was "hacked" 
Dont think so, so SPIP is VERY Safe..
Still the "new problem" from yesterday. ( no acces to spip.php( front page loads, but no content at all ( did look at the loaded page sitename.dk And there absolutely no source code on any/the page, /ecrire ( same problem)
Is this a new problem, or seen before!?

could a wrong lang file from spipbB give this problem ( uploaded to the right folder)
could a single "wrong line" in the same lang file ( spipbb_da.php) result in absolute blank pages!?

The page i keep getting was (when I had problems with the site) was


/spip.php?action=test_dirs&test_dir=tmp/


solutions
erases folder ( /sitename) upload spip a gain, everything worx..


kindly 
Tom

Permalink | Reply | 0 comments |
headers
barnie.de.los.angeles | 9 Nov 20:42
Picon
Favicon

(no subject)

Dear list

Currently I have one instance of spip in  www.main.com. A (yet  
redundant) mes_fonctions.php would read

$GLOBALS['dossier_squelettes'] = "squelettes";

I would like to use this one and only instance of squelettes also in  
a few subdomains such as www.main.com/sub1, www.main.com/sub2, ...,  
and in a few other domains, say www.dom1.com, www.dom2.com, ...

Different domains are on  different servers.

And now my question: how do I have to code the a. m. line in  
mes_fonction.php. (I know this is not a spip rather than a basic php  
problem.)

Thanks a lot.
Permalink | Reply | 3 comments |
headers
Ole Sandberg | 14 Nov 00:52
Picon

restricted user access from public

Hi,

I am looking through the spip-site without luck so I'll post here.
What I'm looking for is an answer to this question:

Is it possible to have a spip-site where unknown users can register
and log in to create articles (but not publish them) without having
access to the private site in general or other articles?
Like it is possible with cms's like phpnuke and others where you can
have a site with user-generated content and still keep administrator
control.
For years I have only used spip as my prefered cms but I am not able
to provide this feature using spip - is it possible?

I assume I need to use the "Automated registration of new editors" in
the site configuration and maybe the code  "#LOGIN_PUBLIC" but I have
not been able to figure out exactly how they work and whether they can
do what I want.

Thanks
Ole
Permalink | Reply | 1 comment |

Gmane