|
|
Home of the Giants |
|
1. update ATX to the latest build how Go to http://www.arrowscripts.com/atx_owners.shtml, download the update package and follow the instructions on the update page. why Always make sure you have the latest version of ATX installed. Many times ATX updates also include security fixes, and critical security issues usually get patched within 48 hours. 2. verify the integrity of the atx files how Go to menu - extra - file check and make sure the checksum of all files is OK. why In the past system files of ATX have been replaced by hackers in an attempt to hide their trojan-spitting files. Running the file check tool makes sure none of the files have been modified / replaced. Note: files which have been set to chmod 0 (no access permission at all) will fail the checksum 3. change & encrypt the username + password how Upgrade to ATX 1.3.07 or higher and change the password, and keep changing the password every month. why ATX 1.3.07 and higher support encryption for the account data. To enable this you need to upgrade to at least ATX 1.3.07, and change the user + pass. Furthermore change the password at least once per month. There's a period of time between the discovery of a security hole, a bot which auto checks installations for the vulnerability, and the actual exploitation of this hole. By changing the password regularly you make sure that an unknown security hole doesn't neccesarily mean you will get hacked. 4. fill out ip access masks how Go to menu - extra - settings - ATX access IP masks. Fill out your IP. If you have a dynamic IP you can fill out a mask like 11.22.3 After filling out this list, chmod the file cgi-bin/atx/d/uip to 444 (read only). why All operations, like logging in, editing trades / toplists / etc are checked against the IP list. Even if an attacker has managed to get your ATX login somehow, he will still have a very hard time actually using it for their evil-doing, because he won't be able to use the atx features to edit files. 5. set template files to read only how In ATX go to menu - Toplists and write down all template (source) files. Change the permissions of these files to 444 (chmod command). why Template files (toplist template in a trade script, index pages in a tgp script) are a popular place to insert trojans / virusses. The reason is simple; template files are parsed and the output is placed in your actual site. 6. disable phpinfo() how In the php.ini file add phpinfo() to the disabled functions list: disable_functions = phpinfo If you're not sure how to do this, ask your tech why The function phpinfo() prints all available EGPCS (Environment, GET, POST, Cookie, Server) data. This is often times a security risk, as it gives an attacker a lot of information about your server. 7. close the signup form (very big sites only) how Go to menu - Trade - sign up form - set sign up form to closed. why For large sites, an open signup form is an open invitation to cheaters. It definately pays to do some extra screening before accepting new trades. Smaller sites however best leave their signup form open, as they run minimal risks; a hitbot is easy to spot when your site is small, and an open signup form will definately help attract new trades that you need to grow. 8. setup htaccess protection how copy-paste the following code in notepad, save the file and upload it with the filename .htaccess Replace the IPs with your own IP and upload the file to cgi-bin/atx/x/ If you get a internal server error after uploading this htaccess file, double check that you've copied the code correct. If the error remains, contact your host, they probably need to change the file httpd.conf to allow such htaccess files to work in the cgi-bin/ directory. why htaccess protection on IP basis is very basic and therefore very effective. By only allowing your own IP to access the admin.cgi and x2.cgi file, it becomes impossible for others to abuse your server through ATX. This htaccess file does almost the same as the ip list as discussed in step 4. |
