Security issue: Need to move site (change site number)

If you have questions about using mojoPortal, you can post them here.

You may want to first review our site administration documentation to see if your question is answered there.

This thread is closed to new posts. You must sign in to post in the forums.
8/7/2012 2:48:20 PM
Gravatar
Total Posts 19

Security issue: Need to move site (change site number)

This is a security issue-- I need to move my default site 1 to another site #.

I discovered upon deleting a site that mojoPortal serves up site 1 if it doesn't recognize the host name. Suddenly, web requests for the deleted site are served by site 1! This exposes customers to embarrassment and security issues.

  1. Is it possible to move or copy a site?
  2. If not, is it reasonably possible to alter SiteId and SiteGuid in a minimum number of DB tables to effect a move?

I would like to leave the default site 1 empty so that deleted sites and erroneous IP bindings in IIS are not served with another customer's web content.

8/7/2012 3:40:28 PM
Gravatar
Total Posts 19

Re: Security issue: Need to move site (change site number)

If I had understood this behavior well in the first place I would never have allowed a customer site to be the default site. Instead, I would have created site 1 as an empty administrative site only.

A make-shift alternative solution would be to implement host name matching on site 1, and perhaps return the content of a particular HTML file or allow a redirect for non-matching host names.

8/7/2012 3:41:20 PM
Gravatar
Total Posts 2239

Re: Security issue: Need to move site (change site number)

Hi Kevin,

The simplest method for this would be to create a "blank" site and take note of it's ID. Then set the IsServerAdminSite=1 for that site in the mp_Sites table in your database. You should then set IsServerAdminSite=0 for the first site.

Your SiteIDs will remain the same but you will achieve the effect of having the blank site as your Admin site.

I definitely suggest you make a backup of your database before attempting this change.

HTH,
Joe D.

8/7/2012 4:16:56 PM
Gravatar
Total Posts 18439

Re: Security issue: Need to move site (change site number)

One thing you could try is altering the stored procedure mp_Sites_SelectOneByHost

Ideally one shouldn't modify the shipped procs but for an emergency like this I'd probably do that if I were you. It hasn't changed since 2006 and probably won't change so you could get away with it. I'd make yourself a note and a backup of the modifed sql statement juat in case it ever does get changed by a mojoportal upgrade.

You could create a specific site that you want to be the catchall and then hard code that site id in oplace of our current sql which just selects the first site ordered by site id.

Specifically you could replace this part of the sql:

DECLARE @SiteID int

SET @SiteID = COALESCE( (SELECT TOP 1 SiteID FROM mp_SiteHosts WHERE HostName = @HostName),
(SELECT TOP 1 SiteID FROM mp_Sites ORDER BY SiteID)
)

with

DECLARE @SiteID int

SET @SiteID = COALESCE( (SELECT TOP 1 SiteID FROM mp_SiteHosts WHERE HostName = @HostName),
(SELECT 15)
)

where 15 in this example is the hard coded site id to catch all un-assigned hosts that resolve to the ip.

You would need to make a similar change also in mp_SiteHosts_SelectSiteIdByHost

Not the prettiest solution but it should work and it is at least easy to do.

Hope that helps,

Joe

8/7/2012 4:44:29 PM
Gravatar
Total Posts 1203
Proud member of the mojoPortal team

Help support mojoPortal!
Add-on modules

Re: Security issue: Need to move site (change site number)

Hey guys, I've never had to change site processing in mojoPortal, so just for my own knowledge:

Joe D. posted a workaround I've seen before for changing the admin site via the database, but is the problem that the admin site and the default site can be different? If so, maybe there should be a supported way to change the default site as well (like an "IsServerDefaultSite" database field, or a configuration key that could override it)? Or maybe the distinction should be removed, so the admin site is always considered the default site? It seems to me that either of these would be a better long-term solution than changing stored procedures.

Jamie

8/7/2012 4:49:33 PM
Gravatar
Total Posts 19

Re: Security issue: Need to move site (change site number)

Joe Davis,

All that does is change which site is the admin site. It does not change site 1 from being the default.

 

Joe Audette,

Yes, that sounds easy and effective and not too precarious. I suppose if it is ever changed, perhaps it would be an enhancement to allow selecting a default site? That change wouldn't hurt me anyway!

I think this might work even better:

SELECT TOP 1 SiteID FROM mp_Sites ORDER BY SiteID, HostName

A site having a blank HostName would order first and become the default, right? The lowest SideID ("1") would order first if host names were not being used, thus retaining the current behavior.

However, I would like to see the non-matching host case result in the administrator's choice of:

  • terminate the HTTP response (play dead)
  • return a generic 404 or 500 (no site page or identity revealed)
  • perform a 301 redirect to a specified URL

Of course, the latter could set up the potential for an endless loop so one would have to be careful with the redirect!

8/7/2012 5:01:14 PM
Gravatar
Total Posts 19

Re: Security issue: Need to move site (change site number)

Jamie,

First question: Yes. The admin site appears not to affect the default.

It would be most desirable to select the default site using a drop-down on the SiteList.aspx page. A configuration key would at least provide the choice, though less friendly. (mojo has too many config keys already, and perhaps an admin page should replace many of them?)

Pretty sure admin/default should remain separate. I can easily see wanting admin hidden, but a default very visible.

I don't necessarily want a default site at all in my case. I could create an entire site just to sit as an empty default, but I'd love to see the following options available if no default is available (no host name match or no default site is designated):

  • terminate the HTTP response (play dead)
  • return a generic 404 or 500 (no site page or identity revealed)
  • perform a 301 redirect to a specified URL

Many thanks!

-Kevin

8/7/2012 5:04:28 PM
Gravatar
Total Posts 2239

Re: Security issue: Need to move site (change site number)

Well, I didn't know there was a distinction between being the Admin site and the "default" site. If there's not a reason for that distinction, I'm all for removing it.

One quick question Kevin, if you don't want the site to respond to a certain domain, why can't you remove that domain from the site's bindings (host headers)? If you're not using host headers, I understand the problem. Either way, you could also use URL rewriting to prevent mojo from ever seeing the request.

Finally, this thread is going on my ever growing list of reasons one shouldn't use the Multiple Sites feature to host sites for different clients. Doing so leads to all kinds of ugliness when clients need to move their sites to another server or different hosting entirely. It makes upgrading more difficult because you have to coordinate with every client, fix any skinning issues that may arise from the upgrade (rare but when it happens needing to fix 50 skins in one maintenance window is real pain in the backside). Don't get me wrong, I use the Multiple Sites feature for many things and I think it's a great capability. The idea of two different clients using the same database for their website data is just very dirty to me.

Thanks,
Joe D.

8/7/2012 5:13:51 PM
Gravatar
Total Posts 19

Re: Security issue: Need to move site (change site number)

If you think about it, the default site would never have a host name applied to it, so wouldn't my SQL suggestion provide the easiest functional solution within the existing parameters? The lowest SiteID with no host name becomes the default.

Provision of a "no response", 404, or redirect when there is truly no default could be a possible feature enhancement. It's purpose would be to eliminate having to create a separate default site when only a blank page or redirect is desired.

8/7/2012 5:20:23 PM
Gravatar
Total Posts 1203
Proud member of the mojoPortal team

Help support mojoPortal!
Add-on modules

Re: Security issue: Need to move site (change site number)

Those using Multiple Sites Based on Folder Names won't have separate host names to rely on. Your SQL could also result in the default site changing unexpectedly if every site had host names defined (this is probably the case in most multi-site installations--it is in ours), and a new site or host name were added that sorted lower than the existing ones.

Jamie

8/7/2012 5:33:06 PM
Gravatar
Total Posts 19

Re: Security issue: Need to move site (change site number)

Joe D.,

I didn't wish to complicate matters by indicating that I am both clients! Cool However my sites serve entirely different purposes and the confusion and embarrassment potential is the same. The ability to move or export sites would be nice (and difficult to implement, I'm sure). Yet, I'd very much hate to have to maintain multiple mojo instances and databases.

I could address the problem with some URL rewriting, I suppose. Also, I should re-examine my bindings.

Generally, I run two IIS sites for each domain---one runs mojoPortal and is bound to a single canonical host name (i.e., www.example.com), and the second has no host name binding. The second IIS site performs a 301 redirect to the first. Any DNS host (i.e., w, ww, wwww, "no-www") or raw IP address will match the second site and be redirected to the canonical host name. I tend to share IPv4 addresses, while having separate IPv6 addresses to each site.

I use separate IIS sites for each domain so that logs are not co-mingled. They all share one application pool for mojoPortal.

Yes, I think I could potentially solve it with bindings. Thanks for pointing that out. Hope I provided some useful ideas.

8/7/2012 5:39:53 PM
Gravatar
Total Posts 19

Re: Security issue: Need to move site (change site number)

Joe D. wrote: "Your SQL could also result in the default site changing unexpectedly if every site had host names defined"

Alas, you are correct. I never thought about defining a host name for site 1 because it's currently always the default. I previously haven't given thought to the fact that deleting site 1 promotes site 2 to become the default without any choice!

8/8/2012 1:36:18 PM
Gravatar
Total Posts 18439

Re: Security issue: Need to move site (change site number)

Hi Guys,

Its currently working exactly as it was designed to work and really this seems like a very minor issue being made into a more of fuss than it should be. The vast majority of mojoPortal installations are single site installations and they do not require any host name to be assigned to a site. When you install mojoPortal the first site is created during installation and it does not require a host name assigned, but if you want to host multiple sites based on host names you must assign any new host names to a specific site, that is a very simple rule and that has always been the instructions. There is no security issue on this thread and I don't see it as a security issue at all. No protected content is leaked. I do see how it could be an embarrasment if you are hosting multiple customers in the same installation and the wrong site comes up but any embarrasment can be prevented by assigning a host name to a site before creating the dns record, and using IIS host headers also solves the problem if a site is later deleted. I've never recommended hosting multiple customers in a single installation and this scenario is just another example of why I wouldn't do that myself though I know some people choose to do that. In this case both sites are your own but again to me its a minor issue that can be solved easily. It is a natural consequence that if you have a site running on a dedicated ip address and you point a host name to it its gonna show whatever site is running there. I don't see how it could be a huge problem that your other site appears there, the host name could not have been that important if you chose to delete the site before pointing it elsewhere. If it is an important host name that people are using you should keep it pointing at an actual running site. The only difference is you would get a dns error or a 404 if there didn't happen to be a mojoportal site running on that dedicated ip address, and I do not see why one would choose to cause a dns error or 404 for an important host name, that would be just as embarrassing.

The first site created also happens to be configured as a server admin site by having IsServerAdminSite set to true. It simply means that that site is allowed to create child sites and change site settings in child sites. There is no technical reason one cannot have more than one site configured as a server admin site, though in practice it isn't what I would do, but its a separate issue vs a default site.

The only reason there must be some site as a default site is because no host name assignment is required for the first site. It wasn't really designed with a concept of "default site", it was designed to host single sites without any extra configuration needed. It seems perfectly logical and reasonable to me that if you want to host multiple sites in a single installation based on host names it is up to you to make sure the host names are assigned to the correct site. I do agree that if you are going to host multiple sites and especially if you are going to host multiple customers in the same installation, its best to plan ahead and make sure your first site is your own administrative site.

There can also be multiple host names assigned to a single site even in a single site installation, so there is no guarantee that any site exists that has no host names just as there is no guarantee that any sites do have host names assigned. mojoPortal is designed to work in either case.

Resolving the site id from the host name must happen on every single page request therefore the sql to do it needs to be simple and performant, I don't want to add any complex logic there and I also don't want to change the current default behavior right now. if it is changed it needs to not break any existing sites and there can already be installations where site 1 has been deleted and the default site has site id 2 or higher, we have no way of knowing, but I know that my site joeaudette.com uses site id 2 because it was once part of the same installaiton as mojoportal.com but was split into a separate installation and site 1 was deleted from that installation. I'm sure others have done similar things when they needed ot move a site our from a multi site installation.

I've logged an item in our project tracker to consider changing this but for now it is a low priority and I don't want to be side tracked from higher priority things that need to be done. If/when I get around to making a change on this I think it will involve having a default site id in web.config/user.config. The way I would implement it the default would be -1 and if -1 is passed we will actually pass null so that it coalesces to the current logic of selecting the first site id it finds, that way upgrading will not change any behavior but if someone wants to force a specific site id as the default it will be possible.

Best,

Joe

8/8/2012 5:25:07 PM
Gravatar
Total Posts 19

Re: Security issue: Need to move site (change site number)

Joe,

Sounds good. I believe I can resolve it with more careful host name binding in IIS.

I delete or disable sites more often than you might think for "important host names" because I do a lot of political sites that need not (and should not) continue after an election or other event. When an issue or candidate web site suddenly becomes another issue or candidate site it is confusing and embarrassing. The extent one might consider it a security issue is debatable, but revealing that two sites are hosted by the same party can be a security problem in some cases.

Same thing for returning 404 or providing 301 redirects. After an election, a redirect or taking a site down is frequently important. Again, I think IIS can handle this.

One useful feature you might consider is the ability to designate a canonical host name when multiple host names are applied to a site. Good SEO practice mandates "example.com" should 301 redirect to "www.example.com". Currently, I create a second IIS dummy web site to catch all the non-canonical host names and redirect them to the canonical name hosted by mojoPortal. I'm not sure how others handle this--probably URL rewriting, but rewriting invokes a regex search on every HTTP request so I disfavor it.

Many thanks for your toil!

8/8/2012 5:41:44 PM
Gravatar
Total Posts 1203
Proud member of the mojoPortal team

Help support mojoPortal!
Add-on modules

Re: Security issue: Need to move site (change site number)

Canonical URL is already available. Take a look at the Forcing a Preferred Host Name document. Just be careful using this, because if it's set wrong you may have to go into the database to fix it.

And thank you, Joe, for the detailed explanation of how and why the "default/unassigned" site works the way it does.

Jamie

8/8/2012 5:52:47 PM
Gravatar
Total Posts 19

Re: Security issue: Need to move site (change site number)

THANKS Jamie! Now I can delete a bunch of "dummy" IIS sites. I wrote an HttpModule in C# that handles this for single sites, but it needs enhancement to work in the situation of multiple sites within one web application.

8/9/2012 10:49:09 AM
Gravatar
Total Posts 18439

Re: Security issue: Need to move site (change site number)

I admit, disposable sites was not something I thought about when implementing support for multiple sites. Your scenario is an interesting use case though and I guess whenever we get to adding a setting for a default siteid it will help with that, but I think it is kind of a corner case. I do see how it could be embarrassing if you're doing sites for both sides of the aisle and the wrong one comes up. Might be best to have a separate installation for republican and democrat sites just to be on the safe side. :-D

8/9/2012 12:38:44 PM
Gravatar
Total Posts 19

Re: Security issue: Need to move site (change site number)

Joe A.,

Thanks for all your responses....

  1. I should have created an admin site as #1, but I was just beginning mojoPortal.
  2. The above could be remedied if there were a way to export/import, move or copy a site. Such a feature would appear to solve migration concerns of others.
  3. I am using your kludged SQL now and it appears to work fine.
  4. I need to tighten up and plug the holes in my IIS bindings.

I hope to contribute to and/or benefit from your HTML5 campaign! Very exciting!

Many thanks. I think I owe you a beer.

Kevin

You must sign in to post in the forums. This thread is closed to new posts.