Access to PMA to anyone???

[grungy]

If you ask me, it is a great security risk that anyone can access PMA just by entering http://www.domain.com/vhcs2/tools/pma/



Wanna know why? Think about it!

If you ask me, a user should be logged to VHCS OMEGA to be able to access PMA!!!!

YES!

[BeNe]

In which together slope is that here ??
I dont understand.... :konfus:

[grungy]

BeNe Wrote:In which together slope is that here ??
I dont understand.... :konfus:

?

[grungy]

Well just to point out, that the setup program in VHCS by default creates a passwordless account for the FTP user! So just by accessing the PMA URL for a domain, entering the FTP username and clicking login without a password would let a 'hacker' in and explose ftp accounts...

By default I mean, the setup program will let you just hit enter, and continue with the setup when you are asked for the FTP USER password...!

[BeNe]

*klick* ok - now i am here

mmmhh, the question is, how to secure PMA ?!
Why dont you use .htaccess ?
You can also change the folder name to anything and make a link in
the VHCS Menue.

[BeNe]

grungy Wrote:Well just to point out, that the setup program in VHCS by default creates a passwordless account for the FTP user! So just by accessing the PMA URL for a domain, entering the FTP username and clicking login without a password would let a 'hacker' in and explose ftp accounts...

By default I mean, the setup program will let you just hit enter, and continue with the setup when you are asked for the FTP USER password...!

A Passwordless account by Default? Are you sure?
In the Setup you were ask about a password for vftp

[grungy]

BeNe Wrote:*klick* ok - now i am here

mmmhh, the question is, how to secure PMA ?!
Why dont you use .htaccess ?
You can also change the folder name to anything and make a link in
the VHCS Menue.

Don't worry about me, I'm thinking about the most of the people out there...they will take things as they are, and leave the default setup.

[grungy]

BeNe Wrote:

grungy Wrote:Well just to point out, that the setup program in VHCS by default creates a passwordless account for the FTP user! So just by accessing the PMA URL for a domain, entering the FTP username and clicking login without a password would let a 'hacker' in and explose ftp accounts...

By default I mean, the setup program will let you just hit enter, and continue with the setup when you are asked for the FTP USER password...!

A Passwordless account by Default? Are you sure?
In the Setup you were ask about a password for vftp

Just hit enter when you are asked for the password...

[BeNe]

Yeah - just hit enter!
But come on, which Sysadmin hit "Enter" on this Question ?

[grungy]

BeNe Wrote:Yeah - just hit enter!
But come on, which Sysadmin hit "Enter" on this Question ?

Yeah, but I like to test stuff...and since you ask, trunk that I was using had a bug that won't let proftpd connect to mysql if the vftp user had a password.