For changing ownership, there's an easy way to use the chown command:
Code:
chown -R www-data:www-data /srv/www
(make sure the R is uppercase)
The "-R" will tell chown to change the user:group ownership to www-data:www-data of the /srv/www directory and everything it can find inside it, and anything inside any subdirectories inside /srv/www, and so on until it can't find anything else inside /srv/www . You need to pay attention when using "-R", though -- if you type the wrong directory, you can throw off your entire system by assigning the wrong user and group and thus throw off anything expecting a certain user and group, and create a major security hazard by allowing the wrong process or user to change things they ought not to. "-R" will also work with chmod. Again, you have to pay attention. To secure off your site, you can do:
Code:
chmod -R 550 /srv/www
chmod 770 /srv/www/yoursite.com/html/upload
550 will tell chmod to allow read and execute permissions to the user and group, and no permissions to everybody else. If www-data is both the user and the group, and only your web server uses www-data, this is the most ideal situation. However, if you need to allow uploads to a certain directory (in my example, that's /srv/www/yoursite.com/html/upload), you would use 770, which allows read/write/execute to the user and group, and no permissions to everybody else.
You also need to check the documentation for WordPress (or anything else you serve up) to see if it needs a certain set of permissions on certain files. Wrong permissions on anything critical to the site, such as config files, will cause most CMSes to malfunction.
If you're wandering about the numbers, read, write, and execute have a certain number assigned to them, and in order to grant a certain set of permissions using chmod, you can add those numbers together as needed. The numbers for the individual permissions are:
Read = 4
Write = 2
Execute = 1
So a '5' would mean Read and Execute since Read + Execute (4 + 1) = 5. Also keep the three digits in order: The first digit will be for the user permissions, the second digit for group permissions, and the third for others, so a 764 would allow the user all three permissions, group would have read and write, and others would have read-only.
There is another method to using chmod. You can also use u, g, and o to represent user, group, and others (or use 'a' to represent all three at once), and r, w, and x to represent permissions:
Code:
chmod u=rwx
chmod g+wx
chmod o-rwx
chmod a=rwx
The first command clears the old permissions for user and sets the user permissions to read/write/execute, with the permissions to group and others remaining the same. The second command doesn't erase the previous permissions, it simply adds write and execute permissions to group and keeps user and others the same. The third keeps user and group the same, and removes read/write/execute from others. The fourth erases the old permissions for user, group, and others and set all three to read/write/execute. If you don't use the first bit (u, g, o, or a) and simply do something such as "chmod +x /some/file", it will assume that you're talking about the user permission; it's good to specify user anyway if you're working with system files just to make it easier to find and correct mistakes.
For blacklisting, I know there's fail2ban, which works with iptables, but I'm not sure if it will work for what you're asking for. From what I understand, fail2ban watches for a DDoS attempt and does a temporary ban of the ip via iptables.
FAQ
Search
Members
Register
Login [ Anonymous ]
)
