Full Disclosure mailing list archives
Re: more on securing php
From: "Elvedin" <mnsan11 () earthlink net>
Date: Wed, 20 Aug 2003 18:05:03 -0500
Sounds to me like he shouldn't be running a web server at all. If he doesn't know what he's doing, (or he wants IIS as a web server) that just shows he's not trustworthy or credible. Did you mention something about a web hosting company? My best advice is to tell him to forget about it. ----- Original Message ----- From: "Justin Shin" <zorkshin () tampabay rr com> To: "Full-Disclosure () Lists Netsys Com" <full-disclosure () lists netsys com> Sent: Wednesday, August 20, 2003 4:58 PM Subject: [Full-disclosure] more on securing php
Hi guys (sorry for the late response but I'm not really supposed to worry
about this stuff at work ya know :) --
Thanks for all your responses. I already knew he shouldn;t be running
apache as root, I have told him before to run apache as a seperate user (eg. "apache") but he has yet to fix this.
Once again, the safe_mode on PHP works __directly with the *nix kernel__ ,
meaning that it makes sure that resources accessed are owned by the currentuser. However, if PHP is called by apache, which runs as root, and if root owns everything ... I think ya get the picture. :) That was my dillema before.
Now about IIS. I have told him to run *nix but he is stubborn as a, umm,
donkey when it comes to this stuff. He refuses to touch it, so I told him apache on Windows. I simply do not *trust* IIS as a stable and secure webserver. At least apache is secure (to a certain degree).
Also, I have thought maybe he could crate a seperate 2k3 user account per
each new user, but then I don't know if safe_mode works with Windows user accounts.
So, basically, he shouldn't really be running apache on windows w/ php at
all, right?
Thanks -- Justin _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- more on securing php Justin Shin (Aug 20)
- Re: more on securing php Elvedin (Aug 20)
- Re: more on securing php Steve Suehring (Aug 20)