Post-install security question

[shellbevx]

Hi

 

I'm new to oscommerce and have successful, or at least I think so, installed in onto my hosts server. I'm trying to follow the instructions about installing and it tells me to change various file permissions to read only etc but it appears my hosting company doesn't allow this and all the files and directories get changed back to 700, read write and execute. Also I'm getting a message at the top of the homepage saying my configure.php file is writable and I should change it's permissions. I'm able to set passwords on the folders if I want to through the hosting company's website if that helps but I really need to know how vulnerable my site is as it is now out of the box so to speak. Can anyone just change my configure.php as it is now?

[Jack_mcs]

Your host may not allow setting the permissions from an ftp program but you should be able to change them via the control panel. If not, ask your host. If they won't let them be set below 700, which is unlikley, then change hosts.

 

Jack

[shellbevx]

I phoned my hosting company and they switched it over to a linux server which allows permission changing. The annoying thing was I had to pay £25 + vat for a mysql database on the windows server as it only came with a free mssql one but when I changed it to the linux server it comes with 10 free mysql database and they won't refund me. One more question though, I've decided to go with version 3 instead of 2 by the way. Once I copy the installation files to my host, do I actually need to change file permissions like it says in the instructions because I didn't change anything with version 2 and it seemed to install okay. And after I install it which folders and files do I actually need to change permissions on? Sorry for all the questions but I don't want to find after I set up shop I've left something vulnerable.

[FIMBLE]

If your host has su_exec installed you may not have to change them initially, but will need to change them onc installed to 444 (400 is best but might not work) 644 may work or it may produce the inseacure error

You need to change files

admin / includes / configure.php

catalog / includes / configure.php

 

and delete the install folder

Nic

[shellbevx]

I seem to only be able to change them too 600, read and write. I can't get rid of the write. Any more ideas?

[FIMBLE]

try using your control panel file manager from your hosts you may have more luck there

Nic

[shellbevx]

Been looking on the host website for something I can use but the only thing I can see if something called SSL Shell access. I have no idea how to use it...