A reminder that upgrading your server might shut down parts of the security related components and leave services unintentionally exposed.

Upgrading should not be done without proper filtering of unwanted incoming traffic (via for example a firewall in front of the server).

Here we can see some database passwords and cryptographic secrets exposed during #debian13 upgrade due to PHP being down while the httpd was not.

#infosec #cybersecurity

  • Harry Sintonen@infosec.exchangeOP
    3·
    13 days ago

    Post mortem:

    This issue was made possible by a misconfiguration whereas “AllowOverride none” was used by accident. That made it possible to read the configuration file even though .htaccess file preventing it is in place.

    So this in part this specific issue was a mistake by the admin (read: myself). I think it still highlights an issue that could occur in many other ways as well. It is best to restrict network access to servers when upgrading them.

    PS: If you can’t do things right at least make it possible for others to learn from your mistakes. 🙂