Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I operate a small shared hosting area. While I notice that people are unable/struggle to exploit with PHP I have found a small minority of people using Perl in order to obtain server information.

So, to put it simply here is the question I would like to ask -

Is there a way to prevent Perl scripts from accessing certain system critical files such as named.conf /etc/passwd & others? Naturally suhosin/ suphp or php.ini does not protect against this when in a perl scenario.

share|improve this question
add comment

1 Answer

chroot the users and/or Apache ( example 1 example 2, example 3 )

share|improve this answer
    
I suggest chrooting both, as well as bind and any other public facing services. –  John Gardeniers May 9 '11 at 2:16
    
Thanks for your response and I cannot agree more. Just one issue, I am running a cPanel/ LiteSpeed setup. While I am sure LiteSpeed will run within the chroot fine, cPanel not so much! –  Chris May 10 '11 at 6:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.