Web server continually hacked

Question

Hi folks,
we are running our organisation's website on a mac mail server (10.4). However we seem to be getting hacked periodically, where our index.php is either replaced or completely deleted. I have ftp switched off, does anyone have any advice on what to do to secure things a bit.
Thanks in advance,
Matthew

Answer 1

does anyone have any advice on what to do to secure things a bit.
Not without knowing more about how it's getting hacked. There just isn't enough information to form an opinion.
For one, you say that FTP is turned off. But what about other protocols? Do you know that the hacker is uploading a new file via a file sharing protocol, or are you running some insecure PHP-based system (such as a discussion board, blog software, etc.) that has known vulnerabilities and allows hackers to replace content via the web.
You should check your access logs. Very often the answer lies right there but it's amazing how many people never think to look.
Then there's the question of whether they're actually exploiting a weakness in the server or whether they're exploiting a weakness in your passwords. Weak passwords are the number one cause of such issues where a hacker with a few minutes and a shell script can try thousands of common username/password combinations and might just get lucky.
You should lock down any admin-level account on your system (whether that's the Open Directory system running the system accounts, or the web application accounts running the PHP software. At the very least change the passwords to something decent.
Without more detail, though, there isn't much more to suggest - all the above is just common sense, really.