Web Site Security

• Make sure your files are secure -- if you set the file permissions incorrectly on your files, then other users, or an out-of-control CGI script may be able to delete or change those files. Do NOT make files world writable unless you don't mind the risk of that happening. Files must be world readable to be served by the web server software.
  
  
• User read access to the non-sensitive areas of the server via Telnet or SSH is normal on Sun Solaris 2.6/2.7 due to the Unix system architecture and is the way all Unix servers work. Our servers have the maximum security possible on a multi-user Unix server. Via FTP, you are restricted to your home directory.
  
  If you would like to restrict access to your home directory - allow full access only for yourself and the minimum necessary for the server daemons - so that other users can not read it, but HTTPD, FTPD, procmail, etc. still can, you should execute chmod 711 . within your home directory using your Telnet login. Note that the public_html directory has to be 755 for proper web page delivery and cgi script execution.
  
  
• Keep your password to yourself -- do not give it to anyone else unless you don't mind all of your site being deleted by them or anyone they may hand the password on to. You are responsible for all use when logged in under your username. If you suspect your password has been discovered by someone (eg. you seem some files in your account that you didn't upload), change it immediately. You should change your password regularly - at least once a month. Make sure to use a full eight character password composed not only of alphanumeric characters, but also others (* ) $ # ; " + _ and so on). Your password should never a dictionary word, numeric only, or anything else easy to guess.
  
  
• If at all possible, avoid using telnet. Use SSH instead. There are three SSH clients available for Windows, links to which can be found in the Web Resources area. Also, you also should not connect directly via FTP. Instead, tunnel it through SSH (supported by F-Secure SSH and SecureCRT only - use the port forwarding feature for port 21).
  
  
• Make sure to keep full copies of all your files locally. If you have dynamic content such as forums, make sure to make a back up local copy of all the changed files frequently. Also, do not store any sensitive data (eg. credit card numbers) on the server. Such sensitive data should be communicated directly to your online processor and/or sent via PGP encrypted E-mail and never stored un-encrypted on a multi-user server.
  
  
• Although we do all in our power to protect your data and upkeep our server security, given the nature of the internet (no server is absolutely secure unless it is disconnected from the internet), we can make no guarantees. You should do all you can to safeguard your password, as well as your data.

If you have any questions or concerns about security, please feel free to Contact Us.