Login or Register to Ask a Question and Join Our Community


Shell Programming and Scripting

grep and check uploads

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting grep and check uploads
# 1  
Old 05-18-2008
grep and check uploads
Hi,


In suhosin php hardening patch there is an option of scanning uploaded files via php or web.


upload verification_script
==============================
*
Type: String
*
Default:

This defines the full path to a verification script for uploaded files. The script gets the temporary filename supplied and has to decide if the upload is allowed. A possible application for this is to scan uploaded files for viruses. The called script has to write a 1 as first line to standard output to allow the upload. Any other value or no output at all will result in the file being deleted.


On a systme with suhosin installed we add In php.ini

suhosin.upload.verification_script = /path-to-scanner.


Can you please advise a scanner script that will scan for:

1) viruses using clamscan

2) grep the uploaded file for certain malicious patterns and if it matches the pattern, the file is deleted

example pattern:

pattern='r0nin|m0rtix|upl0ad|r57shell|c99shell|shellbot|phpshell|void\.ru|phpremoteview|directmail|b ash_history|\.ru/|brute *force|multiviews|cwings|bitchx|eggdrop|guardservices|psybnc|dalnet|undernet|vulnscan|spymeta|raslan 58'

3) email report if it finds any virus or malicious pattern



Thanks
Login or Register to Ask a Question

Previous Thread | Next Thread

9 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Grep: check if a string comes up twice

I have the following files list.txt string1<TAB>ABC string2<TAB>DEF string3<TAB>GHIquery.txt ABC DEF GHI ABCNow I want to check, if a string in the first column of list.txt is twice in query.txt so my command is: while IFS=$'\t' read k v ; do if (($(grep -i '$v' query.txt | wc... (2 Replies)
Discussion started by: tons92
2 Replies

2. Shell Programming and Scripting

ignore fields to check in grep

Hi, I have a pipe delimited file. I am checking for junk characters ( non printable characters and unicode values). I am using the following code grep '' file.txt But i want to ignore the name fields. For example field2 is firstname so i want to ignore if the junk characters occur... (4 Replies)
Discussion started by: ashwin3086
4 Replies

3. Infrastructure Monitoring

Blocking File Uploads with Squid

Dear All I want to block email attachments upload on internet through different mail servers. My requirement is that no user can send email attachments on yahoo, hotmail, gmail etc. I have RHEL-5 and squid 2.7. I have applied the undermentioned ACL but it in vain ACL is acl fileupload... (2 Replies)
Discussion started by: surfer24
2 Replies

4. Shell Programming and Scripting

GREP a directory to check for uppercase

Hello All, I am trying to write a script to search in my current directory to look for all files that end with HTML and look for any HTML tags that are in upper case. for example if I were to grep test.html and test.html has a tag <P> instead of <p> then it would print the file name. This is... (11 Replies)
Discussion started by: rawmaterial
11 Replies

5. Shell Programming and Scripting

Shell script to monitor tmp folder for uploads

Hello, We have been having some issues with our users overwriting files, and then not having a backup. What I would love to do, is create a shell script to monitor /tmp, for uploads, and make a copy of the file they are trying to upload before the upload finishes. Is this possible at all? (6 Replies)
Discussion started by: mrfr0g
6 Replies

6. Shell Programming and Scripting

monitor daily file uploads

hey all, i am a shell scripting n00b so bear with me. i got a server that every night uploads one file to a remote server. the file is prodserver_date_time. i would like to make a script, run by root on a daily cron job. i want it to determine if the file was received or not. no md5... (2 Replies)
Discussion started by: jweinraub
2 Replies

7. Linux

vsftpd hiding partial uploads

Is there any mechanism within vsftpd to hide partially uploaded files, ie give them a hidden file name. Pro ftp has this option with the hidden stor option in the configuration file. If there is no such feature how do I go about requesting that the vsftpd developers create this option or is... (3 Replies)
Discussion started by: jhod22
3 Replies

8. OS X (Apple)

OSX uploads to 2000 server extremly slow

We have just added 5 macs to what used to be an all Windows shop. Everything works great except the macs upload to a windows 200 file server extremly slow. Are there any suggestions to make the upload faster? (2 Replies)
Discussion started by: wbeard6142
2 Replies

9. Cybersecurity

Creating a Password-Protected directory for ftp Uploads & Downloads

Hello All! Am new here; please excuse any blunders! Am dealing with an off-site ISP UNIX server on which no Telnet access and no Anonymous FTP access is allowed, and which is hosting a client web site. Need to create a separate area within that site to hold occasional outside ftp uploads... (3 Replies)
Discussion started by: NAL
3 Replies
Login or Register to Ask a Question

LEARN ABOUT HPUX

dput

dput(1) 						      General Commands Manual							   dput(1)

NAME

       dput - package upload tool for Debian

SYNTAX

       dput [options] [host] package.changes ...

DESCRIPTION

       This  is  a  tool  for uploading Debian packages into the archive. You may specify to which host it should upload the file by passing it an
       host argument. If omitted, dput uses the host specified by default_host (or, historically default_host_non-us) configuration option.   Also
       you have to pass the program one or more name of package.changes files and then they will be sequentially uploaded.

       This  program  will  then  upload  the  package for you into the archive, using a selected upload method. Currently dput supports ftp, scp,
       rsync, http, https, and local. The method scripts have been split from the main script  so  it  is  easy  to  add  new  methods.   Look	in
       /usr/share/dput/ for examples.

       Should  something  go  wrong  with your upload to destinations using the Debian upload queue daemon (e.g. ftp-master), you can remove files
       from the upload queue with dcut(1).

OPTIONS

       -c, --config - define a config file to use.

       -d, --debug - activate debugging mode, helpful if bugs occur.

       -D, --dinstall - do a dry run of dinstall after the upload.

       -f, --force - force an upload of an already uploaded package.

       -h, --help - print help information and exit.

       -H, --host-list - print the lists of hosts that dput knows about.

       -l, --lintian - run lintian before the upload.

       -U, --no-upload-log - do not write a .upload log file after uploading.

       -o, --check-only - check only the package and do not upload.

       -p, --print - print the configuration that dput is using.

       -P, --passive - use passive ftp instead of active. Note that passive ftp is the default unless specified  otherwise  in	the  configuration
       file.

       -s, --simulate - simulate an upload only.

       -u, --unchecked - don't check GnuPG signature on the changes file.

       -e,  --delayed  - Upload to a DELAYED queue, rather than the usual Incoming. This takes an argument from 0 to 15. Note that a delay of 0 is
       different from no delay at all.

       -v, --version - print version information and exit.

       -V, --check-version - check if the user has already installed and tested the package before putting it into the archive.

ENVIRONMENT

       This program doesn't depend on any environment variables. But if the variable USER is set, it will be used.

LICENSE

       This program is distributed under the terms of the GPL.

BUGS

       Please send bug reports to the author.

FILES

       /etc/dput.cf
	      global dput configuration file

       ~/.dput.cf
	      peruser dput configuration file

SEE ALSO

       dput.cf(5)
       dcut(1)
       /usr/share/doc/dput
       /usr/share/dput

AUTHOR

       dput was written Christian Kurz. The current maintainer is Thomas Viehmann <tv@beamnet.de>.

       Many other people have contributed to this code. See the Thanks file.

COMMENTS

       The author does appreciate comments and suggestions from you.

								  October 5, 2001							   dput(1)