2

Normally permissions of folders like /bin & /usr/bin ... are -rwxr-xr-x (755) - executable and readable by anyone. So my idea here is to change permissions to -rwxr-x--- (750) - not anymore executable and readable by others.

I want to limit executing commands inside my system (server).

(I was thinking about scenario where disabled functions of PHP are somehow bypassed and the door for executing commands are now open for malicouse user or attacker (on shared hosting), how can i stop him from executing system commands? (Offcourse premissions on other folders are set to limit his activity!))

Any ideas?

  • 2
    For starters, it doesn't do anything against someone who gains root privileges - and means that you'd have to use root privileges to do some fairly common things, increasing the chances of that account getting compromised. You might want to investigate the use of Mandatory Access Controls (e.g SELinux) to provide a finer grained control. – Matthew Dec 15 '16 at 14:59
  • You would end up adding all local users to the appropriate group, and there would be no (o)ther to be denied... Given your PHP example, the more correct defense would be a chroot jail. – gowenfawr Dec 15 '16 at 15:27
2

Sabotaging the normal usability of your system probably does not increase your system's security.

Of course, root, and thus, much of the system "maintenance" and startup mechanism will still be able to work normally, but you'll run into problems very quickly – what if your webserver writes logs and uses some external command to rotate them? That'll lead to hard-to-predict bugs, potential insecurities …

Even if that was not the case, an attacker that is able to escape their environment (e.g. the PHP interpreter) by executing files from /bin/ will usually also have the privileges to simply write the binaries they need into some other writable directory, mark them as executable and execute them (or they'll just load them as shared objects – or a lot of other things. Basically, the moment an attacker can exec anything, you've given them access at the level that the process is running at, nothing helps there anymore).

0

Changes are your php interpreter is in /usr/bin, so your web processes need to be in the group that has access to /usr/bin anyway.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.