New answers tagged

0

A shell is used (and first executed) when an interactive login happens for this user-id. Putting a value such as bin/false or /usr/sbin/nologin terminates this session and essentially logs the user out. Many system services / daemons do not use interactive logins and are started by other processes, they are assigned a user-id and group-id though, to ...


0

Using shell_exec() and its multiple variants is perfectly fine so long as the web server's user account is limited to its directory structure. The real risk is to use unsafe scripts that run commands with user input. escapeshellcmd() and escapeshellarg() can be used to make that safer. Note that having no login shell does not prevent from running commands ...



Top 50 recent answers are included