designer2 this questions is pretty simple in regards to the thread your talking about. In that thread, an individual uploaded a template to his site, that was intentionally designed for "Dolphin" that he did not obtain from the original creator of the template. In this instance, he obtained it from a pirated software site.
The individuals who passed the template around, installed their own code into the template knowing it would get installed on dolphin sites because that is what it was advertised for. Therefore they were able to exploit the dolphin script with the site owners permission. Templates are comprised of various types of files, css, php, java, flash & image files. Any one of these can contain hacks that open the door and invite other sites in, moving right past any security the server has set up on it.
It does not matter how well you secure a server, if you place a code in your script giving permission everytime someone clicks on a page for it to do certain things then the security will assume that the human who wrote the program knows what they're doing and simply follow the order to allow it to happen. Now, I haven't seen the exact template in question, though I would love to see it, but I am familiar with the modpack being passed around and it is nothing more than a ton of hacks designed to exploit previous versions of dolphin and place commands within the servers root section that allows it to cross from site to site in a shared environment.
You can attempt to secure your server from outbound connections by using the following:
mod_evasive
Bruteforce
mod_security
portsentry
But there is still no guarantee that it will stop everything. In addition, if you do use those programs you run the risk of disabling your own RMS connections and other items that you do want running on your site, which means you have to create exceptions lists to allow them to run.
Now look at it this way, my site runs 482 Radio Stations and each needs it's own access to a seperate site to pull the streaming data. Now I could set up 482 exceptions to allow them to run, but then we have the issue of Global Videos installed on the site and there is no quick way to do those exceptions as the list is constantly changing as to what is available.
So the question becmes how do you set it up to protect it and manage to hold back the hackers without disabling the full site and/or it's features? In the end, dolphin and the server settings do a pretty good job of this, but it's not perfect and never will be. Creating an exceptions list is a daunting task and would require an actual human checking every single link, and that is nearly impossible for a site owner to do when you turn on the number of options some of our sites run.
The best form of protection is to learn coding and what your looking for, check each mod before you install and pay attention to what your doing. Spend time on your site and talk to as many people who join as you can, this is easier when the site is small, not so easy as it grows.
Wish we had an easier way, but so as long as we have people who think they deserver free stuff then we will have people who will try to hack and beat up servers.
