For those interested, you can test your input formats against securitybest practices by trying out http://drupal.org/project/security_reviewnice, thanks:ryan
bayousoft.com
twitter.com/bayousoft
On Fri, Dec 17, 2010 at 10:10 AM, Greg Knaddison <Greg@growingventuresolutions.com> wrote:
On Fri, Dec 17, 2010 at 12:20 AM, Bill Fitzgerald <bill@funnymonkey.com> wrote:All sage advice and good questions.
> * What roles have "administer comments" rights?
> * Are there any VBO-based comments administration views on the site?
> * How secure is the site's database? Is root access still available? If so,
> is the password secure?
> * Is phpMyAdmin installed on the site? That can be a weak spot.
> * Do the Apache logs from the time of the breach show anything odd/curious ?
I think it's not so obvious and not really useful. If the "superuser
> Also, at the risk of stating the obvious, I'd strongly recommend creating a
> superuser role and retiring your UID1 account for everything but
> upgrades/updates.
role" has the permission to "administer users" or "administer
permissions" then any user in that role has the exact same permissions
as UID1. The only difference is, as you state running update.php (in
D7 that distinction is gone - anyone with the right permission can run
update.php).
The idea that "uid1 = unsafe" is a security myth that needs to die.
There are other more likely avenues of attack such as incorrectly
configured input formats.
For those interested, you can test your input formats against security
best practices by trying out http://drupal.org/project/security_review
Cheers,
Greg
--
[ Drupal support list | http://lists.drupal.org/ ]