1
vote
1answer
26 views

How do I find what PHP script is changing the file

I have apache installed with mod_php PHP5. I've been able to find out that apache process is changing my .htaccess and index.php files in /var/www directory. All files in this directory are owned by ...
0
votes
0answers
15 views

Security concerns regarding php://stdin

I'm using xinet.d and php://stdin to host a raw tcp-connnection, (following the excellent guide at http://gonzalo123.com/2010/05/23/building-network-services-with-php-and-xinetd/) I'm concerned with ...
0
votes
0answers
19 views

Which modules can be disabled in apache2.4 on windows

I have an Apache 2.4 webserver running on Windows. I am looking into system hardening and the config file httpd.conf. There are numerous load modules and I am wondering which modules I can safely ...
0
votes
0answers
32 views

Sanity check: wordpress permission/ownership for multihosting

So I have a small server setup (2 webs, 1 nfs / mysql) that's hosting a couple of different wordpress sites. It's currently configured like this: I have a user called wwwuser (uid 500) and ...
1
vote
1answer
119 views

unable to switch off expose_php in ubuntu 14.04 with nginx and php-fpm

According to phpinfo: Loaded Configuration File: /etc/php5/fpm/php.ini # grep expose_php /etc/php5/fpm -R /etc/php5/fpm/php.ini:expose_php = Off ...
1
vote
2answers
272 views

Why can nginx access /etc/passwd? [closed]

I'm trying to setup my new VPS with my couple sites. nginx, php-fpm and other needed services installed. I setup a nginx server block(virtual hosts) for my site, and then try to create a php file ...
1
vote
1answer
27 views

Temporary file security threat? [duplicate]

We use CentOS. We've been hacked and trying to figure out why. Looking at the /tmp folder I'm wondering if these are security threats: -rw-rw---- 1 mysql mysql 11665408 Apr 3 18:59 ...
1
vote
2answers
46 views

Ubuntu Server 13: How to prevent users from exploring the filesystem with php

I hosting websites for several clients who do not have shell access. How do I prevent these users from exploring the system using PHP? Right now, I'm using suphp to their code as themselves, but ...
0
votes
1answer
50 views

Is the following setuid program a security risk?

I have the following program in .c set as setuid chmod only read/execute by owner and will set it immutable, as i will the php script it invokes. #include <stdio.h> #include <stdlib.h> ...
1
vote
1answer
85 views

Securing PHP on Ubuntu 12.04 LTS?

I recently set up an Ubuntu 12.04 server (with Apache 2.2 & PHP 5.3.10). While I was testing it, I noticed in the Apache access logs that an unknown IP address was trying to perform a PHP CGI ...
1
vote
1answer
103 views

Why is PHP open_basedir not considered a security model

On servers doing shared web hosting, or sharing the PHP environment between different PHP applications, I usually implement a security policy that uses PHP open_basedir to restrict each user to ...
1
vote
1answer
69 views

Securely configuring nginx for php

I want to use nginx for both Symfony2 sites and other software like phpMyAdmin. I've read the nginx docs on setting up Symfony2 and came across this issue: ...
0
votes
3answers
68 views

No directory protection for apache

This looks weird, I have an apache httpd server in a CentOS box, which has this security problem: Virtual hosts are enabled, the site is in /data/www/vhost2/index.php It looks like that if I tell ...
-1
votes
1answer
147 views

Exclude fastcgi from running php on an specific folder

Users can upload files on my webserver to a specific directory. In order to be more secure I want to exclude php-fastcgi from parsing PHP scripts in that specific directory. directory = ...
1
vote
1answer
80 views

How does fastCGI PHP alter a file and escape detection by auditd?

The other day I set up a little shell script on a Debian server to send me an email when files change; it looks like this: #!/bin/sh items=`find /var/www/vhosts -regex ".*/httpdocs/.*" -newer ...
-1
votes
2answers
83 views

Risks to have 777 on uploads directory [duplicate]

I have set the permission on my uploads directory(in which end user can upload their documents) to 777. I understand this is not a good idea, but the files wont get uploaded with any other ...
0
votes
1answer
308 views

phppath/php as URL has strange behaviour and seems to be an attack

Warning: The following requests might harm your server. I got some strange things in the apache log: "POST ...
-8
votes
1answer
88 views

LAMP Installation and security [closed]

I installed LAMP server on Ubuntu 13.04 using this tutorial word to word. It worked nicely. But I am hardly able to understand these steps : $ sudo usermod -a -G www-data your_user $ sudo chgrp -R ...
1
vote
1answer
57 views

Keeping PHP up-to-date on a Windows IIS server

On my Windows servers, Microsoft Update keeps IIS and ASP.NET updated automatically. On my Linux/Debian servers, cron-apt keeps Apache/PHP/etc. updated (semi-)automatically. However, I have not found ...
1
vote
2answers
102 views

Hide a php script from external requests

(first question on stack exchange, feel free to comment/criticize) Context I have a Debian server with Flash Media Server (FMS) listening on port 80 and 1935 (which is the default) Apache2 ...
-1
votes
2answers
277 views

How to prevent from uploading shell

What is the best way to prevent from uploading c99shell,r57shell and another php sheller? i want when an attacker upload a shell the sheller don't show for him. I use mod_security ver 1.x Thanks in ...
-3
votes
1answer
101 views

How to block ini_get('disable_functions')

I want to block ini_get('disable_functions') without blocking ini_get() in disable_functions section because when i block ini_get() in my server the roundcube dosen't load, how can i do that?
0
votes
2answers
203 views

Does open_basedir works recursive?

Does open_basedir works recursive? For example if I write in php.ini something like: open_basedir=/client3/web3/web Does it include all directories in /client3/web3/web (/client3/web3/web/1, ...
-4
votes
5answers
343 views

how to protect php app (vbulletin) from hackers

Our vBulletin system is under constant attack, raising cpu load and making the system very slow for legit users. The attack is a script type attack that is attempting to log in and/or create new login ...
-1
votes
2answers
213 views

Techniques for securing mod_php for shared hosting (WAMP)?

I've setup a web server for production use. The OS is Windows Server, and it runs Apache 2.0 and PHP 5.3 as an apache module (and MySQL too...). It is used to host several virtual hosts (Apache ...
0
votes
1answer
203 views

How can I configure a Ubuntu LAMP web server with permissions like CPanel?

I know how to set up a LAMP stack on Ubuntu pretty well for a single website / single user, but I'd like to allow multiple users to host multiple sites on a single server. This is for different ...
-1
votes
1answer
41 views

SSL secured account section, Subdirectory vs Subdomain [closed]

I'm currently running Drupal on an nginx server, and I also have a separate user account system running on account.domain.com. I purchased a wildcard SSL certificate to protect the login form, but the ...
0
votes
1answer
57 views

Security implications of running Apache with php5-fpm as user:user

I just set up VPS to run Apache with php5-fpm which is set to run every user pool as user:user. Reason for this is simply to allow users to actually own their own files created by various CMS ...
0
votes
1answer
101 views

Is the connection from PHP to a different MySQL server 100% secure?

I tried to find this information but was not able to. How is working the connection from PHP to MySQL server. As the password is sored plain, is it also sent plain to MySQL if it is stored on a ...
0
votes
2answers
2k views

How do I disable functions on servers for particular directories?

I want to disable some functions on server to improve security of server. I followed these steps: STEP: 1 Open php.ini file: vi /etc/php.ini STEP: 2 Find disable_functions and set new list as ...
1
vote
2answers
238 views

PHP web hosting: how to prevent clients to DOS/DDOS?

I'm providing a partial web hosting solution where my clients may upload and execute their own php scripts. Besides the security routine I'll have to check (off topic here) I would like to know ...
0
votes
1answer
341 views

Securing PHP's exec and others

I'm currently setting up an hosting service and, for now, i'm very concern about security. Here is my situation : I've set up multiple apache's vhost and for obvious securoty reason, i don't want to ...
0
votes
1answer
96 views

unix malicious scripts/ksh execution

I'm wondering whether my architecture poses a security risk. Details: The whole website is not ROOT owned but still, the APACHE user used instead has some pretty advanced permissions. I have a ...
3
votes
1answer
253 views

Is it possible for Apache to display PHP source code if PHP crashes?

This is more of a security question: Are there any circumstances (i.e. running PHP as a CGI binary versus Apache module, examples of poor default configurations, etc.) where Apache would render the ...
3
votes
3answers
4k views

Isolating Apache virtualhosts from the rest of the system

I am setting up a web server that will host a number of different web sites as Apache VirtualHosts, each of these will have the possibility to run scripts (primarily PHP, possiblu others). My ...
0
votes
1answer
177 views

how limit php script to access parent host directory

I've a debian linux server with apache2.2 & php5 installed. I've created many virtual hosts on my apache server, each virtual host has a separate root directory & php is enabled for all of ...
0
votes
2answers
85 views

Amazon RDS and users, security

By default you got a username and password for your RDS database. Would it be dangerous to use the credentials on your production website, say in php files? Or is it necessary to create a user with ...
0
votes
4answers
587 views

Protect Files from unauthorized access

I have this very big problem I've been trying to solve for last few days with no success. I have some files which are class schedules, these are imported to the server from an external source (html ...
1
vote
3answers
412 views

Security implications of adding www-data to /etc/sudoers to run php-cgi as a different user

What I really want to do is allow the 'www-data' user to have the ability to launch php-cgi as another user. I just want to make sure that I fully understand the security implications. The server ...
0
votes
2answers
375 views

Deny loading of php files if accessed directly (nginx)

I don't know if this can be achieved... I'll try anyway. I'd like to deny php files in a certain folder to be viewable if loaded directly (you point the browser to the direct URL), but only if you ...
0
votes
1answer
45 views

PHP Requests Being Blocked After Making About 25 in Ten Minutes

We have an administrative portal where we run PHP functions through a JavaScript portal using Ajax for administrative purposes. For example, we might have a function called updateAllDatabaseEntries() ...
2
votes
1answer
1k views

Should I use suPHP or DSO (mod_PHP) when php scripts need to manipulate files?

I recently asked a question on StackOverflow and I'm going to re-ask it here as a different question and with some changes and additional information. I have a bunch of php scripts that need the ...
0
votes
1answer
186 views

Finding malicious code injected into MySQL [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I've got a new client whose site looks like it has been hacked. It's running Drupal and I have run Hacked on it to verify that the ...
-3
votes
1answer
119 views

Protecting a chmodded 0777 cache directory?

A website I'm developing requires several directories to have their permissions set to 0777. The directories are used as cache directories for HTML and PHP files generated by the website. The ...
-2
votes
1answer
201 views

PHP SuHosin — my code is already secure… is it needed?

I believe I have set up my code quite securely, it validates and cleans user input so it's safe, etc. So would I need SuHosin? (which is a security addition/patch for PHP) How does it help me if my ...
2
votes
1answer
129 views

Potential Bot-Net organizers probing for new machines?

I'm getting a number of exploit attempts from different IP's today. GET ...
2
votes
1answer
184 views

Does PHP-CGI security issue (CVE-2012-1823) affect PHP running as regular users with mod_fcgid?

Does this PHP-CGI security issue (CVE-2012-1823) affect PHP when it's running under individual regular-user accounts with mod_fcgid? The wrapper .fcgi script I've been using is: #!/bin/bash ...
2
votes
2answers
333 views

How safe is it to allow www-data to run sudo quota?

I manage the hosting of a custom Software-as-a-Service (SAAS) CMS and Ecommerce system. This system is powered by a cluster of LAMP servers behind an HAproxy instance, and each customer / domain has ...
1
vote
2answers
87 views

php security on a system with only known php software (or: need alternative non-PHP CMS)

I have a deep antipathy for PHP due to its security record and the way the project handles security in general. Unfortunately I have to deploy a CMS and I need a modern theme for it. So far I have ...
1
vote
2answers
104 views

How to make a PHP file unavailable to users?

I have a file queue.php which I have set up as a cron job. I don't want users to be able to access it. How can I do this?