Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently setting up an hosting service and, for now, i'm very concern about security. Here is my situation :

I've set up multiple apache's vhost and for obvious securoty reason, i don't want to let a user access other's data by mooving around via php's system's function.

That's why i've set open_basedir in each of my vhost. Nevertheless, I'm still concerned with one major security leak : exec function.

So after some research, i've found that you can use disable_functions in php.ini to , like his name told us, disable some function. I've foud this list of function to disable who seams pretty complete :

disable_functions = "apache_child_terminate, apache_setenv, define_syslog_variables, 
escapeshellarg, escapeshellcmd, eval, exec, fp, fput, ftp_connect, ftp_exec, ftp_get, 
ftp_login, ftp_nb_fput, ftp_put, ftp_raw, ftp_rawlist, highlight_file, ini_alter, 
ini_get_all, ini_restore, inject_code, mysql_pconnect, openlog, passthru, php_uname, 
phpAds_remoteInfo, phpAds_XmlRpc, phpAds_xmlrpcDecode, phpAds_xmlrpcEncode, popen, 
posix_getpwuid, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid, 
posix_setuid, posix_uname, proc_close, proc_get_status, proc_nice, proc_open, 
proc_terminate, shell_exec, syslog, system, xmlrpc_entity_decode"

But, i don't feel right about limiting php for my users. So, two questions :

  • Do you think this is a bloquant situation for most of CMS and other web-application ?
  • If so, is there an other way to isolate each vhost data ?

PS : I've looked for suexec and other's but i think they will not fit beacaus i'm expeting 100 to 200 users on my server and i don't want to create and manage a system account for each one.

share|improve this question

In web hosting industry, especially in shared hosting environment, disabling certain php function is very common due to security reasons. Following are the most common php functions which are blocked:


Also, it is better to manage users separatly for each website becuase then you can easily identify who is doing wrong if anything goes wrong in the server.

For that you can use SuPHP:

Also you can consider following values in php.ini in order to make your server more secure:

  1. allow_url_fopen - disables the ability to open files via an URL
  2. session.save_path - sets the path were php stores its session files
  3. open_basedir - sets the path were php scripts are allowed to open files
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.