2

Normally permissions of folders like /bin & /usr/bin ... are -rwxr-xr-x (755) - executable and readable by anyone. So my idea here is to change permissions to -rwxr-x--- (750) - not anymore executable and readable by others.

I want to limit executing commands inside my system (server).

(I was thinking about scenario where disabled functions of PHP are somehow bypassed and the door for executing commands are now open for malicouse user or attacker (on shared hosting), how can i stop him from executing system commands? (Offcourse premissions on other folders are set to limit his activity!))

Any ideas?

Improve this question
2
  • 2
    For starters, it doesn't do anything against someone who gains root privileges - and means that you'd have to use root privileges to do some fairly common things, increasing the chances of that account getting compromised. You might want to investigate the use of Mandatory Access Controls (e.g SELinux) to provide a finer grained control.
    – Matthew
    Dec 15, 2016 at 14:59
  • You would end up adding all local users to the appropriate group, and there would be no (o)ther to be denied... Given your PHP example, the more correct defense would be a chroot jail.
    – gowenfawr
    Dec 15, 2016 at 15:27

2 Answers 2

Reset to default
2

Sabotaging the normal usability of your system probably does not increase your system's security.

Of course, root, and thus, much of the system "maintenance" and startup mechanism will still be able to work normally, but you'll run into problems very quickly – what if your webserver writes logs and uses some external command to rotate them? That'll lead to hard-to-predict bugs, potential insecurities …

Even if that was not the case, an attacker that is able to escape their environment (e.g. the PHP interpreter) by executing files from /bin/ will usually also have the privileges to simply write the binaries they need into some other writable directory, mark them as executable and execute them (or they'll just load them as shared objects – or a lot of other things. Basically, the moment an attacker can exec anything, you've given them access at the level that the process is running at, nothing helps there anymore).

Improve this answer
0

Changes are your php interpreter is in /usr/bin, so your web processes need to be in the group that has access to /usr/bin anyway.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .