Category: FrontPage

Categories
blog FrontPage Security

Securing your site

Since I’ve seen so many customers getting their accounts hacked I figured I’d post the tools I have to try to deal with these types of issues.

One of them can be found here, (I removed the link because the guy removed the wiki from his site.) it was written by one of my co-workers. (His scripts should only work on Linux/Unix based OS’s, sorry no Windows support.) Basically he wrote a script that checks for some easy to discover vulnerabilities such as having register_globals enabled or world writable files among other things. He also wrote a script to fix those issues, one to tell you if any changes have occurred since the last time the script was run, & he converted my FrontPage clean up script for SSH.

I also made it so that the security scanner he wrote can work in PHP. (Once again this is only for Linux/Unix servers.) You can get it here.

Categories
blog FrontPage work

Update on the FrontPage Server Extensions cleanup script

Well as I mentioned earlier I made a script for cleaning up the Microsoft FrontPage Server Extensions. I have recently made some major overhauling of it. Now instead of running a series of searches to find the offending files & folders, only one search is done making it much less intense on the server, or at least that is the hope.

Another thing only the first few versions deleted the “.htaccess” files. I had someone help me figure out how to rename them instead. I used that command through version 3.5 after which I made 4.0 which didn’t do that.

If you want to get a copy of every version I remembered to save you can obtain it here. Of course if you want the current version you can get it here.

Now that the script is written entirely in PHP I’m going to see if I can do anything to improve the script’s performance further.

Categories
blog FrontPage work

More on the Microsoft FrontPage Server Extensions

Well I figure it is about time that I make another post. Back to the subject of the Microsoft FrontPage Server Extensions. Well I’ve seen way to many customers at Bluehost using things they shouldn’t with the Microsoft FrontPage Server Extensions being used on their account. Here is a list of some of the offenders HotLink protection, Password Protect Directories, IP Deny Manager, Leech Protect, anything that uses mod_rewrite (examples would be Joomla & WordPress), & just about anything that thinks about touching the “.htaccess” file(s).

So I ended up leaning some SSH commands to do the cleanup. The only problem is that I have to jump through several hoops to run them. I then found a way to run the commands from inside a PHP file which made it even easier. So now yes I have a php script that cleans out the extensions. (Please note I only developed them to work on Linux servers & I highly doubt they will work on Windows servers.)

I know you might think it a little extreme to delete every last file & folder with the following names, but if you knew how frequently & easily they broke you might understand. The names of the files & folders that get deleted are the following .htaccess, postinfo.html, _vti*, _themes, _private, _overlay, _fpclass, _derived, & _borders. I know this means you have to republish any web, but it does cleanup the server 100% thus if the borders or themes are broken it is coming from your copy of Microsoft FrontPage which is broken, your web is broken, or the configuration file is corrupted.

Categories
blog DNS FrontPage Internet Microsoft work

FrontPage Server Extensions

Well I guess it is time I make another post.

Here is what I know about the Microsoft FrontPage Server Extensions & how to troubleshoot them.

1) Go to http://www.yourdomain.com/_vti_bin/shtml.exe (replace “www.yourdomain.com” with the domain in question. This works on Windows based web servers, Unix based web servers, & Linux based web servers.). You should get the following message ‘Cannot run the FrontPage Server Extensions on this page: “”‘, anything other than that indicates the server extensions are broken, that means they need to be reinstalled. The exact procedure depends on your web host so I won’t post directions for doing that.

2) If you are not able to open site with http://www.yourdomain.com (replace “www.yourdomain.com” with the domain in question.). If this lets you sign in, only asks for user name & password once. They are working otherwise they are broken or something is preventing you from signing in. The causes of it not signing in are vast and many if the extensions are not truly broken. On Linux & Unix servers it is frequently the “.htaccess” file has something screwed up in it. On Windows servers I’m not sure because I never had this happen with the extensions not being broken.

3) You can’t publish in FrontPage on a 16-bit TCP/IP stack as it requires a 32-bit stack, I’m not sure which version this started with, but I know that at least FrontPage 98 required it & above. This means AOL customers, unless AOL decided to actually use a 32-bit TCP/IP stack.

Oh Microsoft has a good article on how to tell if the FrontPage Server Extensions are installed & working. OH & yes I did write the article, I have no idea why they said it is for FrontPage as it is for the FrontPage Server Extensions versions 98, 2000, & 2002. That’s right even though Microsoft made FrontPage 2003 the last extensions were the 2002 extensions.

Well thats all for now I’ll post more another time.