I operate a small shared hosting area. While I notice that people are unable/struggle to exploit with PHP I have found a small minority of people using Perl in order to obtain server information.

So, to put it simply here is the question I would like to ask -

Is there a way to prevent Perl scripts from accessing certain system critical files such as named.conf /etc/passwd & others? Naturally suhosin/ suphp or php.ini does not protect against this when in a perl scenario.

link|improve this question

40% accept rate
feedback

1 Answer

chroot the users and/or Apache ( example 1 example 2, example 3 )

link|improve this answer
I suggest chrooting both, as well as bind and any other public facing services. – John Gardeniers May 9 '11 at 2:16
Thanks for your response and I cannot agree more. Just one issue, I am running a cPanel/ LiteSpeed setup. While I am sure LiteSpeed will run within the chroot fine, cPanel not so much! – Chris May 10 '11 at 6:59
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.