[SOLVED] Security Concerns

[pgentoo]

Roundcube has recently had some exploits which were used to do such things. THis happened on one of my customers VM's. We did the following, and haven't had problems since.

You can harden php settings a bit to limit this, there is plenty of info online about this. Usually involves disabing a few mothods, etc.

Also remove links,lynx,wget,curl access from normal users (chown root:root, chmod 700), to make it harder for them to get the binary to your server.

Further more, you can mount your /tmp with "noexec,nosuid". This will block any stuff that is uploaded to /tmp from being executed by the script. This is good to have regardless.

Protecting against stuff like this is an ongoing process, and needs constant attention. Setting up active monitoring of your systems (notification when things are "strange"), will let you respond to and fix these types of issues.

Also look into installing mod_security, and setting up a basic set of rules to protect against common exploit types. Note that using ALL the rules, will break lots of sites, so pick and choose what you use...

I hope that helps,

-
pGentoo