Version : 1.0.1
Date : 2013/02/22
Copyright (C) 2009-2013 Kevin J. Zoll (kzoll@zolltech.com)
Copyright (C) 2009-2013 Zoll Technologies (http://zolltech.com)
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.
A weak point in e107 installations is that "e107_config.php" contains the clear text information required to connect and log onto the MySQL database.
Include Files:
/Encrypt_e107config
a.php
Disclaimer.txt
License.txt
README.txt
secureconfig.php
Installation:
A weak point in e107 installations is that "e107_config.php" contains the clear text information required to connect and log onto the MySQL database.
It reads something like:
<?php
/*
+----------------------------------------------------+
| e107 website system
| e107_config.php
|
| ©Steve Dunstan 2001-2002
| http://e107.org
| jalist@e107.org
|
| Released under the terms and conditions of the
| GNU General Public License (http://gnu.org).
+----------------------------------------------------+
This file has been generated by the installation script.
*/
$mySQLserver = 'DB PATH';
$mySQLuser = 'DB USER';
$mySQLpassword = 'DB PWD';
$mySQLdefaultdb = 'DB NAME';
$mySQLprefix = 'e107_';
$ADMIN_DIRECTORY = "e107_admin/";
$FILES_DIRECTORY = "e107_files/";
$IMAGES_DIRECTORY = "e107_images/";
$THEMES_DIRECTORY = "e107_themes/";
$PLUGINS_DIRECTORY = "e107_plugins/";
$HANDLERS_DIRECTORY = "e107_handlers/";
$LANGUAGES_DIRECTORY = "e107_languages/";
$HELP_DIRECTORY = "e107_docs/help/";
$DOWNLOADS_DIRECTORY = "e107_files/downloads/";
?>Normally e107_config.php can not be viewed by direct access of the file. However, there is always a possibilty that an intruder may be able to access e107_config.php, by exploiting a improperly configured server or by exploiting a previously unknown vulnerablity.
I have modified a php script, originally written for phpBB2, that will encrypt the MySQL Database Credentials in your e107_config.php.
Download Encrypt_e107config.zip
- Download Encrypt_e107config.zip
- Backup e107_config.php to a secure location. You may need this file, if something were to go wrong.
- Upload "secureconfig.php" and "a.php" into the document root of your e107 installation.
- Change the file attributes of "a.php" to CHMOD 666
- Run "secureconfig.php" and replace the 5 parameters in e107_config.php ($mySQLserver, $mySQLuser, $mySQLpassword, $mySQLdefaultdb, $mySQLprefix) as directed by "secureconfig.php".
- Add include_once('a.php') to your e107_config.php as directed by "secureconfig.php".
- Replace e107_config.php on the server with the newly modified e107_config.php
- Ensure that the file attributes of e107_config.php is set to CHMOD 644
- Change the file attributes of "a.php" to CHMOD 644
- Delete "secureconfig.php"
This php script encrypts/decrypts the 5 values using the "server path" as the key. $_SERVER['DOCUMENT_ROOT']
The server path (where your e107 is installed) is something like /home/username/public_html and is unique for each e107 installation. Even on the same server this path differs for each e107 installation.
Even if an attacker knows the decryption algorithm (a.php) and knows the encrypted password, they couldn't decrypt anything because the server path is unknown to them.
In other words: It's pretty secure. An intruder would have to find out your server path (which is unlikely unless an attacker has FTP access) And they would have to know the code of "a.php" and they would need to install "a.php" somewhere and they would have to modify it a bit.
NOTE: If your path changes then you have to rerun the program.
- Replace e107_config.php on the server with the backup copy of e107_config.php
- Upload "secureconfig.php" and "a.php" again
- Rerun "secureconfig.php"
Do NOT use the same password for your database as you use for your FTP login or for e107 login.
When editing e107_config.php, make sure that the last line contains only 2 characters: ?>