If you ask me, it is a great security risk that anyone can access PMA just by entering http://www.domain.com/vhcs2/tools/pma/



Wanna know why? Think about it!

If you ask me, a user should be logged to VHCS OMEGA to be able to access PMA!!!!

YES!

In which together slope is that here ??
I dont understand.... :konfus:

BeNe Wrote:In which together slope is that here ??
I dont understand.... :konfus:

?

Well just to point out, that the setup program in VHCS by default creates a passwordless account for the FTP user! So just by accessing the PMA URL for a domain, entering the FTP username and clicking login without a password would let a 'hacker' in and explose ftp accounts...

By default I mean, the setup program will let you just hit enter, and continue with the setup when you are asked for the FTP USER password...!

*klick* ok - now i am here

mmmhh, the question is, how to secure PMA ?!
Why dont you use .htaccess ?
You can also change the folder name to anything and make a link in
the VHCS Menue.

grungy Wrote:Well just to point out, that the setup program in VHCS by default creates a passwordless account for the FTP user! So just by accessing the PMA URL for a domain, entering the FTP username and clicking login without a password would let a 'hacker' in and explose ftp accounts...

By default I mean, the setup program will let you just hit enter, and continue with the setup when you are asked for the FTP USER password...!

A Passwordless account by Default? Are you sure?
In the Setup you were ask about a password for vftp

BeNe Wrote:*klick* ok - now i am here

mmmhh, the question is, how to secure PMA ?!
Why dont you use .htaccess ?
You can also change the folder name to anything and make a link in
the VHCS Menue.

Don't worry about me, I'm thinking about the most of the people out there...they will take things as they are, and leave the default setup.

BeNe Wrote:

grungy Wrote:Well just to point out, that the setup program in VHCS by default creates a passwordless account for the FTP user! So just by accessing the PMA URL for a domain, entering the FTP username and clicking login without a password would let a 'hacker' in and explose ftp accounts...

By default I mean, the setup program will let you just hit enter, and continue with the setup when you are asked for the FTP USER password...!

A Passwordless account by Default? Are you sure?
In the Setup you were ask about a password for vftp

Just hit enter when you are asked for the password...

Yeah - just hit enter!
But come on, which Sysadmin hit "Enter" on this Question ?

BeNe Wrote:Yeah - just hit enter!
But come on, which Sysadmin hit "Enter" on this Question ?

Yeah, but I like to test stuff...and since you ask, trunk that I was using had a bug that won't let proftpd connect to mysql if the vftp user had a password.