6

Let's say that i have shared hosting and i want to secure that place, from executing shell commands. I'v installed suphp, so that users can execute PHP separately. I also did some other things in order to protect server (basedir and other recommended settings inside php.ini).

But the problem is still there: (i can execute and read config files from other websites)

<?php echo exec('cat /var/www/website/config.php'); ?>

If i disable exec function, still there are other ways to find out sensitive information from the server.

What can i do? Can i disable unix shell commands for specific user, will that take effect?

Edit: I'v changed premission on bin 754, before it was 755, and now users are unable to run shell commands using PHP. Is this a solution or not?

  • I think I understand now -- you are the admin on a shared web host and want to prevent users from being able to view files owned by other users? – nyxgeek Feb 1 '16 at 9:53
  • Yes, that's right. – Mirsad Feb 1 '16 at 13:56
1

Disable exec and suexec, enable open_basedir and basically follow every suggestion in this post.

You mentioned still there are other ways to... if after reading that post you still have questions or weaknesses, please post them here or in Serverfault

| improve this answer | |
  • why not? All these are good suggestions – Purefan Feb 1 '16 at 21:48
1

I'v changed premission on bin 754, before it was 755, and now users are unable to run shell commands using PHP.

I think, this is interesting solution. But separation of security rules is not convenient for specific users in this case.

I would like to suggest few other ways:

  1. Run apache as chroot. But it requires complex configuring. It allows to create "isolated" execution-space for each virtual host (execution user). In my opinion, good example described here: Apache + Chroot + FastCGI + PHP FAQ

  2. Run apache and php inside Docker container. It is more modern solution for vhost isolation. But it requires complex configuring too.

  3. Disable potentially unsafe functions via disable_functions directive in php.ini. This is more simple and less safe way. For example:

    disable_functions=dl,system,exec,passthru,shell_exec,stream_select,popen,proc_open,proc_nice,ini_set

Potentially unsafe functions may be found here: Functions restricted/disabled by safe mode.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.