What forum software is safe to run?

awolfe

My wife runs a low-traffic discussion forum that is currently hosted on vanilla phpBB. The simplicity of phpBB is appealing. She is also interested in Drupal because the features are attractive.

But I have been concerned about security, and last weekend I got a serious wake-up. A friend called me in near-panic, because his server had been cracked. He hosts a number of high-traffic web sites on a dedicated server, and he was convinced that he had been rooted. The load average was around 12, and a bunch of processes like strobe, ssh-scan, madscan, pscan2, sambas, scan and vuln were using all the cpu.

It turns out everything was running under the apache userid, and getting rid of the junk was pretty easy. Fortunately my friend keeps his kernel and apps current, and he was not rooted. And whoever did this has not been back for another try. We have not figured out exactly how he got in, but our best guess is through some php hole.

So it makes sense to me that programs like phpBB and Drupal are masked. I read somewhere that Gentoo forums use a highly modified version of phpBB that is secure. Is this available?

If not, what is the best forum software to run, considering security first and features second?

Thanks,
Alan Wolfe

Sh4d0w · n00b Joined: 26 Nov 2003 Posts: 28

phpbb is pretty good, where you run into problems are:

1) Running insecure mods/addons.
2) Not turning on "safe mode" in php

awolfe · Posted: Tue Jul 05, 2005 7:27 pm Post subject:

That's interesting, thanks. My wife is not running any phpbb mods, and I can try turning on php safe mode on. But are these packages masked simply because safe_mode defaults to off in php.ini? That can't be the only reason.

Are there any other options to consider?

As a side issue, I can suggest to my friend that he should enable php safe_mode on his server. And he will probably do it until his users start complaining. They are running a lot of php packages, including a variety of e-commerce apps. When safe_mode issues come up, rather than deal with it, many php package docs and support forums just say "find a new host". So unfortunately that may not be a viable option for him.