Re: PHP Security Risk?

[Daniel Rubio <drubior () tinet org>]

PHP configuration file (php.ini) offers various directives to make 
"safe" things as file uploads.

In most cases, people can put via FTP those dangerous scripts (ISP 
services e.g.) which you are talking can be uploaded so it's necessary 
to take the security mesures before.

Directives as safe_mode, open_basedir, disable_functions and many others 
are useful to make relatively secure these functionalities, needed for a 
lot of web apps. Read about them in the PHP  manual.

At last, sysadmin has the control ;-)

q q wrote:

> oh yeah, a sysadmin's gonna disable file uploads on a production box
> and not get ten tonnes of hell from the development team and clients
> when their websites stop working?
>
> general security is the domain of the sysadmin, but the sysadmin
> can't/won't look through every bit of PHP code to make sure people are
> using move_uploaded_file() and not copy(), is she? I mean, come on.
>
> Security of the box is the responsibility of the one who looks after the box
> Security of the code is the responsibility of the one who looks after the code
>
>
> On Fri, 3 Dec 2004 16:17:34 -0600, Greg Donald <destiney () gmail com> wrote:
>
> > On Fri, 3 Dec 2004 15:48:32 +0100 (CET), John GALLET
> > <john.gallet () wanadoo fr> wrote:
> >
> > > The real danger is that this security part is left te be handled by the
> > > *programmer* not the sysadmin.
> >
> > Wrong.  Sysadmins have full control over the httpd.conf and the
> > php.ini files.  Any functions, classes, file extensions, execution
> > access, etc., that he/she feels unsafe may be disabled quite easily.
> >
> > Web server security involving PHP is certainly not 'left to be
> > handled' only by the programmer.  The sysadmin has many facilities to
> > ensure a secure environment exists.
> >
> > --
> > Greg Donald
> > Zend Certified Engineer
> > http://gdconsultants.com/
> > http://destiney.com/


--
********************************************************
Daniel Rubio Rodríguez
OASI (Organisme Autònom Per la Societat de la Informació)
c/ Assalt, 12
43003 - Tarragona
Tef.: 977.244.007 - Fax: 977.224.517
e-mail: drubio a oasi.org
********************************************************