Securing PHP Under shared hosting

internetpixie

Hi there,

We currently run alot of shared hosting under NT 4 with IIS4. We're getting alot of requests for PHP support so I'm looking into it.

I've installed PHP4 under the development machine, and it all seems to be working fine, using the CGI .exe rather than the ISAPI filter.

I would prefer to use the ISAPI filter if possible for efficiency.

Also, as I don't know very much about PHP myself, I don't know what kind of system commands it can attempt ?

Running it as an ISAPI filter means that it should run in the security context of the website which means that file permissions are limited only to the website that runs PHP, however I found with Perl that you could still get it to run system commands, even as the ISAPI filter.

Has anyone done this ?

cheald

I've not done it, but PHP can run any command it can get access to. I'm not sure how ISAPI works, but there are many shared hosting services out there that offer PHP, so I'm sure they have been able to secure it.

My best advice would be to deny read access to any non-web folder for any user but the admin. That will prevent them executing system commands.

mithril

Keif,

The functions used by PHP to execute system commands are:

escapeshellarg()
escapeshellcmd()
exec()
passthru()
system()

You can disable this functions with the following line in your php.ini file:

disable_functions = escapeshellarg,escapeshellcmd,exec,passthru,system

HTH,

Cheers,

Geoff A. Virgo

internetpixie

And this is all you need to secure it from any possible attacks against the system ?

Is there anywhere you can point me to regarding the use of these commands so I can test it out ?

Thanks alot 🙂

Keif

mithril

Keif,

I wouldn't say that's all you need to do to secure your server against attack, but it will prevent people from remotely executing programs on your server. Another function you might want to disable is dl(). This is used for loading extensions (php_gd.dll, etc.) at runtime. I don't know if this could cause a security hole or not, but you probably don't want people uploading and using extensions that you, or your company's sys. admin, didn't load onto the server.

Chris mentioned denying read-access to all non-web folders from all users except the admin. I would definately do this as well. Regarding a working example of a site with these functions disabled, I can't help you there since I don't know of any. What you could do is setup an internal virtual host and just play with it yourself. I'd also suggest grabbing the Zend Optimizer from www.zend.com when you switch over to ISAPI. It doesn't offer any security benefits, but it does make PHP code run much faster (between 40 - 100% speed increase). The Optimizer needs PHP to be installed as ISAPI (or a module on Apache) to work, it doesn't work in CGI mode. HTH,

Cheers,

Geoff A. Virgo