By drupalina on

My website has suddenly began showing Internal Server Error 500...
Turns out that Hostmonster.com (my host) has found out today that Symlinks are the new security threat. So they've disabled it for all their websites hosted by Hostmonster. Thus the 500 error.

I spoke to the telephone support for 1 hour...

Once you disable the line
Options +FollowSymLinks in your .htaccess , Drupal begins to spit data back at you... BUT without a theme, CSS or javascript. In other words, the website looks hacked, and pretty much non-functional.

But here's another twist... it turns out that Drupal is useless without the the Symlinks. So now all of my websites (including their subdomain websites) on Hostmonster are a total mess.

Has anyone heard about this new Symlinks security exploit that as of today threatens to take down the Web as we know it?

Can Drupal function without symlinks? Is symlinks a serious security threat?

Does anyone have a Drupal website with Hostmonster? How does it appear to you? Is it fine or is it just me?

(I'm now seriously considering moving, but don't know where...)

⋅ Categories: Drupal 5.x, Drupal 6.x

Comments

suzan24k’s picture

suzan24k commented

Want to follow answers. :-)

suzan24k’s picture

suzan24k commented

Not sure if Hostmonster fixed my .htaccess file, but my sites are now working and I didn't change anything. Either they undid their "fix" or fixed my file. hmmph

jshimota01’s picture

jshimota01 commented

Add me to the list. I use custom colored garland. No multisite or anything at all. just demoing to the client and POOF. color went away and all is white. If I set back Garland to Default, it displays and I can move on but all my customizations to the theme are lost.

jshimota01’s picture

jshimota01 commented

wow. I got mine to work and heres how.

The Garland theme has an option to customize colors, which my client needs/wants. When you override the default Garland theme, it creates a subfolder called /public_html/sites/default/files... etc and ALSO creates a .htaccess. Inside my failing .htaccess (identified by reviewing my ISP errorlogs) I found:

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
Options None
Options +FollowSymLinks

Now, Bluehost has indeed made a change that will affect me, and also assumedly users of file folders for uploads as well as multisites users too, if I understand drupal a bit. My original .htaccess (at the root folder) from my virgin install looked like this (clipped out...):
.
.
.
# Follow symbolic links in this directory.
Options +FollowSymLinks
.
.
.

Now it looks like this:

# Follow symbolic links in this directory.
# For security reasons, Option followsymlinks cannot be overridden.
#Options +FollowSymLinks
Options +SymLinksIfOwnerMatch

The change it seems is being done via script by Bluehost . I verified this on the phone with the support guy. As well, I also verified they are indeed directly related to Hostmonster so I assume this affect them as well the same way. My support guy read me an email explaining that they modify the .htaccess file on all sites via scripts if they find the string 'Options +FollowSymLinks'.

My fix for me was to ftp into the site, and edit the .htaccess file in the subfolder. (I tried to put their change back, but it just reappeared... :) )

my final .htaccess file in the subfolder looks like:

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
Options None
# Options +FollowSymLinks (commented by JAS)
Options +SymLinksIfOwnerMatch

and viola. My world came back to life. I realize that if I ever rewrite the color scheme I risk the problem returning, but for now this gets me forward. I asked the bluehost guy to suggest his programmer rethink this, or at least impart his change sitewide... I truly hope this helps folks a bit!

bmx269’s picture

bmx269 commented

How can I get this to work on a Multisite install? The main .htaccess had that change already.

Small Robot - Drupal Web & Print Media

hishaman’s picture

hishaman commented

@Shu I was having the same problem and thought someone hacked my website, but I was comparing my .htaccess file to an older backup and found that it has been changed the same way exactly happened with you. I am on BluHost by the way

I did the changes to my .htaccess file at the "subfolder" as you said and Damn it WORKS... THANK YOU !

bmx269’s picture

bmx269 commented

Found the answer...
http://drupal.org/node/702106

Small Robot - Drupal Web & Print Media

waldmanm’s picture

waldmanm commented

@shu - thanks a bunch. This happened right as I was importing my sites folder into svn and checking it out again, so I was sure I did something wrong. I wasted a day (and a night's sleep) on this ... Very disappointed at Bluehost, who've been very responsive so far.

Quick tip for folks trying to find their .htaccess files: go to your Drupal root folder and from a shell run "find . -name .htaccess". This will give you a list of all files named .htaccess in the Drupal directory tree. I had a couple more at ./sites/default/files/backup_migrate/manual/.htaccess and ./sites/all/modules/amfphp/amfphp/.htaccess but didn't need to modify them as they didn't have the "offending" option.

Micah

hongpong’s picture

hongpong commented

I also noticed it caught an incorrect executable flag and replied "FIXED" in bold, then when i hit reload the file came thru.
Concurring it seems to work ok if

Options +SymLinksIfOwnerMatch

is inserted into the /sites/all/files/.htaccess .

gavranha’s picture

gavranha commented

I start my day looking at a broken site. Blue Host made the changes without a warning, without a message, without a letter at all.

I would like to ask you, experienced and newbie developers: is this the correct measure for a hosting company?

I think this is NOT a correct measure - changes made without warnings - but I would like to know what you think.

Thanks. (now I need to spent my morning fixing the mess...)

gggdrpl’s picture

gggdrpl commented

I noticed something was wrong with one of my sites late at night (images weren't displayed). Then I saw the same was happening with all the sites I have hosted with Hostmonster in three separate accounts.
It really did not take me too long to find this post and the explanation and solution to the problem but obviously I had to edit every htaccess file as instructed above.
I didn't receive any notification from Hostmonster about this changes. Besides there's the fact they don't care about what kind of software (Drupal in this case) you have running in every site. They only edited the root directory's htaccess files and that's all! Lucky me I noticed this problem tonight and not until tomorrow because on of my clients is very quirky about his website not functioning right!
A guy I know told me good about a company called Host Excellence. Can someone give me a little feedback on this recommendation? Thanks!

antza’s picture

antza commented

I have more than 10 Drupal websites on Hostmonster.

I had the same problem - and contacted "live chat" twice today and got no meaningful answer.

The first guy I spoke to told me that there was a problem with .htaccess on the server & it was being fixed.

The second guy told me to reinstall or contact the Drupal developers - yeah, right ;)
He also said he wasn't aware of any .htaccess issue & that .htaccess was my problem, not Hostmonster's ;)

While there may be issues with symlinks (I'm not convinced) the practice of making global changes without informing customers or support staff is just ridiculous.

I have followed the helpful suggestions posted here on how to fix this - everything is working again - but I feel like Hostmonster has dropped the ball badly on this one and it would be great if they would respond here and give us some assurance that they won't do something as stupid as this again. While hostmonster is budget hosting, that doesn't imply recklessness like this - or does it?

gggdrpl’s picture

gggdrpl commented

It's been more than six hours since I noticed this weird problem with my websites and I haven't gotten any notification or apology from Hostmonster in my email inbox yet. I also logged in to my control panel and they didn't even put a warning there! In the meantime we have done what was necessary to investigate and solve the problem to keep our sites running. I think I'm pretty much angry about this situation!!!

antza’s picture

antza commented

I agree, and am also angry and frustrated.

I don't think this is unusual though - I can't recall Hostmonster EVER communicating with me about a planned outage or to explain why there was a problem. This is par for the course. So don't hold your breath for notifications or apologies.

Arrogance or incompetence? Maybe. Certainly poor customer service and communication.

tuccio’s picture

tuccio commented

I have several sites with Bluehost and experienced the same problem.

It was very unprofessional and unconsederate of Bluehost/Hostmonster to implement such far reaching change without warnings.

However, if the security exploit turns out to be a very serious threat (I have no idea. Anyone?), then one might understand such action considering that reaching by email the great number of users of these providers would take time.

yaworsk’s picture

yaworsk commented

Thank you for posting the solution to this problem. I also had problems with 4 sites hosted by bluehost.

I agree this was pretty ridiculous. I get up every day at 5:30am to work for an hour and a half on developments before heading to my full time job and this morning I spent the entire time trying to find a solution to this problem. Absolutely no forewarning from Bluehost.com about this change.

Thank you for taking the time to post the solution.

Pete

Toronto Website Developer

wespay’s picture

wespay commented

I had been working on this problem for hours, thanks for the fix guys! Time to send a nasty letter to you know who.

taote’s picture

taote commented

I think it's terrible to make such a change and don't send a single email about it. I had the same problem with HostMonster, and I´ve spent several hours trying to find out what was happening.

WildBill’s picture

WildBill commented

Jeebus.... thank you so much for this thread. I just spent upwards of 3 hours trying to figure out why my images weren't showing (in the /files subdirectory). Thanks to the fix above, everything's working again.

I'm on BlueHost, and I've sent them a message referencing this thread.

tuccio’s picture

tuccio commented

Has anyone any detailed information about this alleged exploit? Should the next Drupal release modify the default .htaccess?

hongpong’s picture

hongpong commented

the basic problem is described from a thread back in Dec
http://drupal.org/node/656022
Including that this is an issue on other shared hosts. the Bluehost tech was telling me that this was regarded as a pretty big deal for Apache -- also they felt they didn't have to email anyone if the downtime would be less than 30 minutes.

WildBill’s picture

WildBill commented

... yeah, except the downtime was quite a bit more than 30 minutes if all your pictures disappeared....

Mackee’s picture

Mackee commented

Where all on the same boat... I submitted a ticket maybe 8 hours ago, and still havent got any reply from hostmonster. And thank God for this community. Thanks for the fix!

This is what I love the most with Drupal!!! c:

www.raincreativelab.com

Melissamcewen’s picture

Melissamcewen commented

I was just training a beginner in Drupal yesterday and this morning I got an email that her whole site was broken and she didn't know what to do. She thought it was her fault. Shame on Bluehost/Hostmonster for doing this to people. It means lots of us who helped people set up sites there will have to deal with upset people.

But I thank everyone on the forum for helping find a solution! You guys rock!

lastar84’s picture

lastar84 commented

I'm restoring sites now, but this is a "Terminal Error" in my opinion. Not so much as a simple email from Hostmonster to advise customers before or after the change. The relationship is over.

I blew hours searching through files and databases, comparing backups and live sites, and and trying to determine what went wrong.

I would not advise Hostmonster to any Drupal user.

sweg-grindle’s picture

sweg-grindle commented

I ran into the same thing and temporarily fixed it by commenting out Options in the .htacess file.

But Options +SymLinksIfOwnerMatch works like a champ; thanks @jshimota01!

For the record, I never got a notifications from Hostmonster, either. An apology would be nice; this does shake my confidence.

How ironic that this thread has a Bluehost ad banner over it!

efarmer’s picture

efarmer commented

I had the same issue earlier. I logged into BlueHost and went to File Manager through the CPanel -- just do a search at the top right for .htaccess and I manually edited each .htaccess file. You should have this already in your file:

Options +FollowSymLinks

Change and Add this:

#Options +FollowSymLinks
Options +SymLinksIfOwnerMatch

That solution worked for me!

caravinci’s picture

caravinci commented

Dunno why you're having such problems... my symlinks are working fine on hostmonster.
Could it be different problem?

thorshammer’s picture

thorshammer commented

Having read the above (and being the first I'd heard of this), I first checked my .htacess file and confirmed it still contains:

# Follow symbolic links in this directory.
Options +FollowSymLinks

Then I checked with technical support at Hostgator, and was advised that they have had no issues with Symlinks and continue to support them.

Regardless of the above, I always recommend Hostgator because I have experienced no better Support anywhere - quick and helpful. I am NO expert with Drupal in any way, however I also appreciate the level of Drupal support there. Access to databases, and control over basic PHP and .htacess settings via cPanel is very good in my limited experience.

FWIW.

zydu’s picture

zydu commented

I recently changed hosting and noticed I cannot even start installation. I was gettting 500 Internal Server Error until i commented following:
Options -Indexes
Options +FollowSymLinks

Unfortunately adding "Options +SymLinksIfOwnerMatch" to main .htaccess file causes the exact error. Does it mean that there is no workaround to see the pictures?

Having Options +FollowSymLinks or Options +SymLinksIfOwnerMatch in .htaccess in default/files folder doesn't cause any crashes but it wont help either...

postscripter’s picture

postscripter commented

IF you are a newbie like me and on a shared host, you would probably not need .htaccess files because you are not overriding any settings set by the host. So to solve the issue just rename .htaccess files (or delete them after backing them up, in case needed later).

This is an article from my host:

https://supremecenter21.com/help/view-article/?id=36