Security

[Qtech]

Hello guys, I was thinking of sending this via PM but I think that is frowned upon.
I have read much on Lowendtalk about sentora warning.

Has this security issue been fixed?

[apinto]

Please read this thread.
Probably all your questions are already there

http://forums.sentora.org/showthread.php...t=security

[Qtech]

Doesn't answer all the questions but I understand.

Also I think it would be wise for you guys to address these questions on reddit, and other forums.

[Dave]

Have you been hacked? I will guess not so and the guy who started ranting about it did not either I guess its just talk… and  BS.
 
As far as I know ZPanel did not get hacked it was a module some one created saying use this in your ZPanel and you can do good things with it. What people did not realise that the module had coding to access ZPanel server. Now the rest is it gave access to your server (not hacked).
 
I was running Zpanel 6.1.1u same server over two years and hosting clients with no issues.

[Qtech]

Have you been hacked? I will guess not so and the guy who started ranting about it did not either I guess its just talk… and  BS.
 
As far as I know ZPanel did not get hacked it was a module some one created saying use this in your ZPanel and you can do good things with it. What people did not realise that the module had coding to access ZPanel server. Now the rest is it gave access to your server (not hacked).
 
I was running Zpanel 6.1.1u same server over two years and hosting clients with no issues.

If I was an expert in Linux I would probably have an idea if I was hacked. I do know that there is an issue with Bandwith which rewrites conf file. I am not sure if this a hack or a bug because I know there were no issues on reaching bandwith.

I have read the previous thread and I still stand by that the negative publicity has to be handled correctly.

[ahsan]

There exist some very dangerous bugs in the Sentora as well. A user can compromise domains of other users and all. I have sent a private message to TGates and Me.B about the issue.
No response yet.

[Dave]

There exist some very dangerous bugs in the Sentora as well. A user can compromise domains of other users and all. I have sent a private message to TGates and Me.B about the issue.
No response yet.

Is this in the FTP client (File Manager) at the bottom of your control panel your talking about?
 
Can you shed some more light on this….?

[apinto]

There exist some very dangerous bugs in the Sentora as well. A user can compromise domains of other users and all. I have sent a private message to TGates and Me.B about the issue.
No response yet.

ahsan you are probably referring to this: https://github.com/sentora/sentora-core/issues/172
and http://forums.sentora.org/showthread.php...&pid=10796

It was alreeady reported and it is being fixed (with some modules already fixed).

[ahsan]

@[apinto]
 Let alone the user panel bugs there are numerous bugs regarding to Server security and user privacy.
I was just testing my Sentora server and I'm really, really disheartened right now.
All the websites on the server are run under apache user. And if any account of the user is compromised, The attacker can gain access to all the websites and users on the sentora.
All you need is a back-connect script. And you can change files of any website in any directory or any user.

[Ron-e]

All the websites on the server are run under apache user. And if any account of the user is compromised, The attacker can gain access to all the websites and users on the sentora.
All you need is a back-connect script. And you can change files of any website in any directory or any user.

isn't this protected/locked in by suhosin?