Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We've got a standard PHP-based shared hosting for some non-profit organizations. Users can upload over FTP any PHP apps, and we're worrying that some of them aren't properly maintained, f.e. updated.

Are there any scripts or programs that could automatically find what apps are installed, where are they and what versions?

I'd imagine them to work like anti-virus scanners, that is: have a database of "signatures" (for example a set of strings to be matched against .php files). It has been suggested that simple md5/sha1 sums won't work, as many of the configuration files are modified by user.

share|improve this question
    
Voted to delete my answer. You might want to update your question to address what has already been suggested and ensure it appears near the top of the Unanswered stack. –  danlefree Feb 8 '11 at 14:09

2 Answers 2

up vote 2 down vote accepted

You may have some luck with a vulnerability scanner like Nitko2, Nessus, Wapiti or SkipFish. They'll likely have the ability to finger what applications are installed, and more importantly, tell you if any of them are vulnerable to any known exploits.

share|improve this answer

There's nothing already written that will do this out of the box. If you are worried about specific software packages, you can easily do this with some shell scripts.

I'd worry more about ensuring the users cannot do any harm to each other, and that you have working backups of all the sites.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.