Networks

Ask something
Discussion Locked

Security Hole or false alarm?

0 helpful
6 replies

by michbloch

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am running a NetWare 5 network with a website hosted externaly. There is no firewall currently set up for the network here but is at the provider. Recently a user posted a file to the website. He didn't however upload the document, so it pointedto the server for the file. After correcting this (he uploaded the file), you can still see the path on the server where the file is located in the address/location bar on the browser.
My question is this:
Even though I can't access anything by selecting a different directory, how much of a threat is that and is there any way to prevent that from showing up? Any suggestions would be appreciated.

6 replies

by kevin anderson

If you have a server that can be seen directly from the internet, you have a security problem. I love Novell, and they have a great product, but if you can read ANY file in ANY directory on your server from the internet, you have a security problem.

The cheapest, fastest way to put up a firewall would be to throw up a Linux box. Download and burn a copy of RED HAT 7.1 It's an easy install, and it will even prompt you with the different levels of firewall you'd like to have installed automatically. You could install it on an old, slow POS PC, and it'll work, but if you aren't familiar with Linux, then run it on a Pentium class box with 96 Megs of ram (or more). A small box will meet you needs totally, but a bigger box will make the install as easy as Windows 95 (or better).

Then after that is in place, worry about learning how to administrate at, and improve the firewall. Search this site for Jack Wallen's IPChains tutorials. It's REALLY good.

The second question is about preventing it from appearing in history. This can be purged, methods differ depending on the internet browser you use, but if you don't use it, it will disappear automatically after a minuite or two.

Hope that helps.
Kev.

by estebandelatorre

I think that your Web app security is the worng thing here. When you put an Ip address/location, the web program shows you the directory contents (unless is read only, you don't like it).
1.- Usually updates are made by FTP. Ypur provider should give you a user/password in order to update your page.
2.- In this case the app has it's own update method, but:
a.- It must not be linked to any other page. That is to said that the only way to reach the page is http://ip/location but not browsing the site.
b.- This page (the update one) should start SSL authen methods. Define a user and password in the web security tab of this page.

This discussion is closed to new replies.