I'm trying to setup my new VPS with my couple sites.
nginx, php-fpm and other needed services installed.
I setup a nginx server block(virtual hosts) for my site, and then try to create a php file for test. Everything working well, but then I want to try
echo file_get_contents('/etc/passwd') file for security check. And its work too, a test.php file can access my VPS etc/passwd file and more.
After I try
echo shell_exec('ls /') and this show my root folders.
So is this normal? Or how can I prevent this. I want to deny access to all except
www-data user wich running php codes.
Sorry for my bad English.