oss-sec mailing list archives
Re: Security risk of vim swap files
From: "Simon Waters (Surevine)" <simon.waters () surevine com>
Date: Tue, 31 Oct 2017 14:46:59 +0000
On 31 Oct 2017, at 12:23, Hanno Böck <hanno () hboeck de> wrote: I was wondering how to best avoid this on my own servers and I first thought about saving the swap files to tmp ( with "set directory”).
The specific website issue, the web server config can exclude dot files. Apache ships with <Files ~ "^\.ht"> Order allow,deny Deny from all </Files> The obvious generalisations of this work. Although some sources also recommend blocking in “Location” to prevent requests with “*/.*stuff” which are parsed by templating libraries or other directives. To rub salt in most distros ship Apache with IndexIgnore .??* *~ *# RCS CVS *,v *,t Which means that if you use the Apache directory indexing approach these files will be hidden but not blocked. I now realise the Alexa top 1 million will now be searched for remaining uses of RCS and CVS ;) In a previous role the roll out scripts cleaned this sort of junk and told you if any new files had been added to the web application, this approach has much to recommend it if you have the time to perfect your applications, and your roll out procedures.
Attachment:
signature.asc
Description: Message signed with OpenPGP
Current thread:
- Fw: Security risk of vim swap files Hanno Böck (Oct 31)
- Re: Fw: Security risk of vim swap files Solar Designer (Oct 31)
- Re: Fw: Security risk of vim swap files Stefan Bühler (Oct 31)
- Re: Fw: Security risk of vim swap files Solar Designer (Oct 31)
- Re: Fw: Security risk of vim swap files Stefan Bühler (Oct 31)
- Re: Fw: Security risk of vim swap files Apostolis Hardalias (Oct 31)
- Re: Fw: Security risk of vim swap files Jakub Wilk (Oct 31)
- Re: Fw: Security risk of vim swap files Solar Designer (Oct 31)
- Re: Fw: Security risk of vim swap files Adam Shannon (Oct 31)
- Re: Fw: Security risk of vim swap files Gordo Lowrey (Oct 31)
- Re: Fw: Security risk of vim swap files Solar Designer (Oct 31)
- Re: Fw: Security risk of vim swap files Jason Cooper (Oct 31)
- Re: Security risk of vim swap files Simon Waters (Surevine) (Oct 31)
- Re: Security risk of vim swap files Matthias Luft (Nov 07)
- Re: Fw: Security risk of vim swap files Tim (Oct 31)
- Re: Fw: Security risk of vim swap files Kurt H Maier (Oct 31)
- Re: Fw: Security risk of vim swap files Tim (Oct 31)
- Re: Fw: Security risk of vim swap files Steffen Nurpmeso (Oct 31)
- Re: Fw: Security risk of vim swap files Leonid Isaev (Nov 01)
- Re: Fw: Security risk of vim swap files Simon McVittie (Nov 01)
- Re: Fw: Security risk of vim swap files Tim (Nov 01)
- Re: Fw: Security risk of vim swap files Jeffrey Walton (Nov 01)
- Re: Fw: Security risk of vim swap files Kurt Seifried (Nov 01)
- Re: Fw: Security risk of vim swap files Kurt H Maier (Oct 31)
- Re: Fw: Security risk of vim swap files Solar Designer (Oct 31)