3 ms·
Somewhat related question: is there any way to detect hidden web shells that may be installed on a Linux server? Something like a script that pings a webhook an
by yosito 6y ago
Somewhat related question: is there any way to detect hidden web shells that may be installed on a Linux server? Something like a script that pings a webhook any time any user logs in? I suppose that would be easy to disable if a hacker knows what they're doing. But it could be another layer of security that could tip off an administrator that something is happening.
- theamk 6y agoIn the modern web dev, you don’t want a mutable web root at all - instead, when you run your deploy command, the entire web root is removed and replaced with latest version from git. So there are few chances to have “web shells” as long as your git repository is intact, and you deploy periodically. That said, if you want extra security, you can add a process monitor which sends an alert any time there is an process running with web server‘s user.
- yosito 6y agoThis is a good point. Though I mostly install PHP apps like WordPress or Nextcloud that I'm not managing with git. But I should probably deploy them with something like Docker that I could re-build easily.