Harden Your Drupal Websites - From: Imminent Web Services

Events happening in the community are now at Drupal community events on www.drupal.org.
phunster's picture
Posted by phunster on October 18, 2011 at 12:45am

http://www.imminentweb.com/technologies/harden-your-drupal-websites

Categories: , , , ,

Comments

Is that your site? Some of it

Posted by pwolanin on October 19, 2011 at 3:10am
pwolanin's picture

Is that your site?

Some of it seems reasonable, but some is wrong like:

"Especially, since Drupal-5 and 6 require PHP-5.1.6 and up, you should make sure you remove php3/4 modules."

Drupal 5 and 6 only require PHP 4

Another example is that removing the .txt files is considered a mostly pointless exercise - anyone who cares has other ways to fingerprint the site version.

Harden Your Drupal Websites

Posted by phunster on October 19, 2011 at 2:57pm
phunster's picture

It's not my site, aside from the errors, it seems helpful.

As to the text files, I would agree with you, with one caveat. If your site has been specifically targeted, then it is indeed a pointless exercise, if not, this adds another step for the intruder. It has been shown (I can't cite a source, it's been a while since I worked in security) that in at least some cases the intruder will move on and look for an easier target. It's one of those precautions that while pointless much of the time, can't hurt.

I will forward your corrections and the url of this thread to them.