more on securing php

["Justin Shin" <zorkshin () tampabay rr com>]

Hi guys (sorry for the late response but I'm not really supposed to worry about this stuff at work ya know :) --

Thanks for all your responses. I already knew he shouldn;t be running apache as root, I have told him before to run 
apache as a seperate user (eg. "apache") but he has yet to fix this.

Once again, the safe_mode on PHP works __directly with the *nix kernel__ , meaning that it makes sure that resources 
accessed are owned by the currentuser. However, if PHP is called by apache, which runs as root, and if root owns 
everything ... I think ya get the picture. :) That was my dillema before.

Now about IIS. I have told him to run *nix but he is stubborn as a, umm, donkey when it comes to this stuff. He refuses 
to touch it, so I told him apache on Windows. I simply do not *trust* IIS as a stable and secure webserver. At least 
apache is secure (to a certain degree).

Also, I have thought maybe he could crate a seperate 2k3 user account per each new user, but then I don't know if 
safe_mode works with Windows user accounts.

So, basically, he shouldn't really be running apache on windows w/ php at all, right?

Thanks

-- Justin

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html