Security with PHP

clau_bolson · 02-03-2004, 07:18 AM

Hi!
I've just realized that with PHP I can open any file in my disk with world read permissions, no matter apache's configuration says
<Directory />
Options none
Allow override none
Oder deny,allow
Deny from all
</Directory>

As I share my web server with my mail server, I am afraid that one of my users would place a script and be able to stole sensible data (like mysql databases)

Is there a way to restrict which files PHP can open?
Thanks

Khabi · 02-03-2004, 03:56 PM

Yes, it is possible to restrict php from opening files. http://us2.php.net/features.safe-mode All of those options are in php.ini

chort · 02-03-2004, 04:30 PM

Even with Safe-Mode PHP has had some exploits with being able to open world-readable files. Make sure that your PHP is patched or updated to a version that covers all the known security exploits (try checking SecurityFocus.com for a list of PHP exploits, it's gauranteed to scare your socks off).

Another very sensible thing to do would be to chroot Apache into it's operating directory (often /var/www). OpenBSD does this by default.