> i was recently hacked into all my accounts (including banks and lost all my money) and then i preyed
> they didn't FTP all my php scripts because that would be 3 years worth of work lost in seconds
What you seem to be describing has nothing really to do with web server security as such.
You most likely had a trojan on your local computer, and someone was being sent your
username/passwords every time you used them, perhaps over a period of weeks.
To prevent this happening again I would:
- never use Internet Explorer (use firefox instead)
- use a GOOD, PROVEN antivirus (currently I use Avira)
- use a GOOD software firewall with HIPS (currently I use Online Armor)
- never run untrusted or cracked downloaded executables on the same computer you bank with
- use Firefox password manager or a virtual keyboard to evade keyloggers
- always log on from a computer you can almost guarantee is clean from viri/trojans
For SERVER security, realise that very few account hacks are done directly through ftp login.
Disable anonymous ftp if possible, and use a very strong password on your ftp account.
That's all you need to do (in conjunction with using a clean computer to log on).
Much, much more important is to have the server's firewall configured properly
(which is usually done by the host for a shared account) and to have up-to-date,
trusted, well-written scripts, that have authors who respond to security issues
when they are found.
> because that would be 3 years worth of work lost in seconds
Does that mean you don't have local backups!? My databases are backed up twice per day, and the files once per week. These are all stored locally. My local computer then has an incremental disk image taken every night to external drive. If you don't have a strategy similar to this, you absolutely will lose your web data at some point in the future.
Apologies to sound so serious, but when you're hit by a trojan as badly as you were (money stolen from your bank!!??), that should have been a wake up call to do some research and understand the security issues affecting your computer and its software, and it doesn't sound as though you've done that at all. For instance, suggesting that someone from your webhost should/could write an add-on 'notification' script for Pure-FTPD/Cpanel/Plesk is quite naive!
|
Linear Mode
