Re: Moving Plone sites | Tipps & Docs

Hacked at what level? Did the intruder gain the Manager role? Did they gain
rights at the root of the database or just in a single Plone site?

If it was worst case, and I had to deal with a nightmare like this, I might
do the following:


   1. Do a clean Plone install on a new machine or virtual machine.
   2. Install whatever add-on packages I needed from known good sources.
   3. Transfer the file and blobstorage to the new machine.
   4. Add a brand-new emergency user for the database.
   5. Log in as that user and delete all other users from the root
   acl_users.
   6. Create a brand new Plone site in the new database.
   7. At the ZMI level, copy Plone content -- and only Plone content --  to
   the new site.
   8. Do not copy -- and immediately delete if you do copy -- any page
   templates, scripts or CMF controller scripts, templates, or actions. Unless
   you know enough to audit them.
   9. Do not copy the acl_users from the old site. Do not copy any Plone
   tools or property sheets or folders.
   10. Recreate known needed users and have them set new passwords.
   Emphasize that the passwords must be new.
   11. Watch the logs of the new zope/plone with total paranoia for some
   time.


On Mon, Feb 2, 2015 at 6:56 AM, Wolfgang Jeltsch <[email protected]
> wrote:

> Am Montag, den 02.02.2015, 15:21 +0100 schrieb Armin Stroß-Radschinski:
> > Take a look at
> > https://plone.org/documentation/manual/upgrade-guide/
>
> I think this only discusses upgrading an existing Plone installation,
> not moving sites to a new Plone installation.
>
> > Better than your idea: Change the Plone version in the old buildout
> > (the staging copy!) and rerun buildout to upgrade Plone
>
> This is not really appropriate for my case. My server might have been
> hacked. So I want to get rid of any code, because it could be modified.
> As a result, I have to do a fresh install.
>
> > Tipp: Copy over the var/filestorage/Data.fs file and the whole
> > var/blobstorage directory including the invisible .layout file
>
> I guess this would copy over a lot of Python code, which could be
> modified by an attacker. How can I only copy non-code data like web
> pages and user databases?
>
> All the best,
> Wolfgang
>
>
>
> ------------------------------------------------------------------------------
> Dive into the World of Parallel Programming. The Go Parallel Website,
> sponsored by Intel and developed in partnership with Slashdot Media, is
> your
> hub for all things parallel software development, from weekly thought
> leadership blogs to news, videos, case studies, tutorials and more. Take a
> look and join the conversation now. http://goparallel.sourceforge.net/
> _______________________________________________
> Plone-Users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/plone-users
>

------------------------------------------------------------------------------
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/

_______________________________________________
Plone-Users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/plone-users