|
|
|
|
|
|
IT Security and Insecurity Portal |
|
|
PHP version 6 --> safe mode gone! |
|
Posted: Sat Nov 17, 2007 9:02 pm |
|
|
waraxe |
Site admin |
|
|
Joined: May 11, 2004 |
Posts: 2407 |
Location: Estonia, Tartu |
|
|
|
|
|
|
http://ee.php.net/features.safe-mode
Code: |
The PHP safe mode is an attempt to solve the shared-server security problem. It is architecturally incorrect to try to solve this problem at the PHP level, but since the alternatives at the web server and OS levels aren't very realistic, many people, especially ISP's, use safe mode for now.
|
Code: |
Warning
Safe Mode was removed in PHP 6.0.0.
|
|
|
|
|
|
Posted: Sun Nov 18, 2007 9:22 am |
|
|
pexli |
Valuable expert |
|
|
Joined: May 24, 2007 |
Posts: 665 |
Location: Bulgaria |
|
|
|
|
|
|
|
|
|
|
|
php6 |
|
Posted: Sat Mar 01, 2008 10:36 pm |
|
|
woot |
Regular user |
|
|
Joined: Jan 26, 2008 |
Posts: 5 |
Location: Germany/Russian |
|
|
|
|
|
|
I think thats not a big problem becouse open_basedir was not removed thats like a chroot for php files. With suhosin its possible to disable all danger php Command.
Just my 2 cent |
|
|
|
|
|
|
|
|
Posted: Sun Mar 02, 2008 12:15 am |
|
|
waraxe |
Site admin |
|
|
Joined: May 11, 2004 |
Posts: 2407 |
Location: Estonia, Tartu |
|
|
|
|
|
|
Php.ini has "disable_function" setting, so it's easy to block functions.
If safe mode will be gone, then there is two situations:
1. webserver admin blocks all php shell related functions, so that it's hard to break out of "open_basedir". Still there are other ways - cgi, perl, python ...
2. if php shell functions are available, then "open_basedir" means nothing - because we can access filesystem via shell. In this case all depends on webserver operating system security: file and directory permissions, jail, suexec, etc. I have seen LOTS of hosting servers with poor cross-virtual-host security ... |
|
|
|
|
|
|
|
|
Posted: Sun Mar 02, 2008 4:23 am |
|
|
woot |
Regular user |
|
|
Joined: Jan 26, 2008 |
Posts: 5 |
Location: Germany/Russian |
|
|
|
|
|
|
waraxe wrote: | Php.ini has "disable_function" setting, so it's easy to block functions. |
Yes i know but i see exploits where i can the protection of "disable_functions" from the php.ini bypass.If i disable the same command in suhosin the bypass failed. But in php6 i read is suhosin integrates.
waraxe wrote: |
1. webserver admin blocks all php shell related functions, so that it's hard to break out of "open_basedir". Still there are other ways - cgi, perl, python ...
2. if php shell functions are available, then "open_basedir" means nothing - because we can access filesystem via shell. In this case all depends on webserver operating system security: file and directory permissions, jail, suexec, etc. I have seen LOTS of hosting servers with poor cross-virtual-host security ... |
Yes thats the reason why i hosting on my own server. The most important reform for me in php6 is Namespaces and Unicode suport. (Yes i know that namespaces are announced for php 5.3) |
|
|
|
|
|
|
|
|
Posted: Sun Mar 02, 2008 9:29 am |
|
|
pexli |
Valuable expert |
|
|
Joined: May 24, 2007 |
Posts: 665 |
Location: Bulgaria |
|
|
|
|
|
|
waraxe wrote: | 2. if php shell functions are available, then "open_basedir" means nothing - because we can access filesystem via shell. In this case all depends on webserver operating system security: file and directory permissions, jail, suexec, etc. I have seen LOTS of hosting servers with poor cross-virtual-host security ... |
Don't forget log's.Может у тебя все функции врубленъй но логи.POST,GET,COOKIE,HEAD и есчо md5 checksum на каждъй файл.Если зальеш новъй файл на сервак все равно у админа мигает красная лампочка и с твоим шеллом пипец.Мое имхо что safe mode включают тока ламеръй которъе незнают как настроить сервак. |
|
|
|
|
|
|
|
|
Posted: Sun Mar 02, 2008 4:00 pm |
|
|
woot |
Regular user |
|
|
Joined: Jan 26, 2008 |
Posts: 5 |
Location: Germany/Russian |
|
|
|
|
|
|
[quote="koko"] koko wrote: | safe mode включают тока ламеръй которъе незнают как настроить сервак. |
правда, there are many certain solutions as safe_mode. For example fastcgi and suphp.
btw @ koko: i was 5 times in Bulgaria at Holidays. In Goldstrand, Albena and Varna. |
|
|
|
|
www.waraxe.us Forum Index -> Php
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|