I am security administrator for a shared Linux web hosting. I have done my level best to secure the server in many ways within the possible limitation. Means, As it is shared hosting, there will be 1000s of various website, I can not make safe_mode=on or simply off the file_upload. As it is shared hosting, most of the customers might need many options, So i have to provide all the options and still make the server secure.
I think, If i do this one work, it could further strength the shared server. You can assume, i have done most of the security tips available in Internet for securing Linux system.
I have installed cxs for scanning the web & ftp upload, It does a decent job and also i have modified the upload hook in a such a way that, malicious code is blocked. But cxs does not block the malicious code 100%
On top of all the above security steps taken, I want to implement one thing. I want to find out all the upload directories in the all the website and disable the execute permission for those directories, How can I achieve it ? For example: If any website is having a folder "upload" or "user_uploads" dirs, I want to find out those dirs using PHP or shell script and disable the php engine or remove executable permission to those dirs. So, If I can achieve it, Even if malicious code is uploaded to the server, It can be blocked from execution.
Please help me how can I achieve this ?