Topic: Tip: disable_functions in PHP

[Steffen]

A lot of you know it already, but still I want to share;

Today a Apache users reported to me that users with upload facility where able to excute windows commands.

They uploaded a script and could execute for example:

<
shell_exec('c:/del *.*')
>

It is advised to put in your php.ini:

disable_functions "phpinfo,dir,readfile,shell_exec,exec,virtual,passthru,
proc_close,proc_get_status,proc_open,proc_terminate,system"

With this setting users cannot execute windows commands. Note that also phpinfo is in the list, to prevent that users can see your php configuration.


Steffen

[James Blond]

For security it is more safe to set a open_basedir to the webroot. So you can use all function even exec but only in webroot.

[NthDegree]

Repartition the HDD to have all the server bits in one partition.

Then block all access to drive C using NTFS permissions!

That tactic even stops directory traversal vulnerabilities from being of any real use.

Also, another nice tip is to use safe_mode_exec_dir to allow exec family of functions to run only in the directory needed!