php filesafe and security problems

[ozux]

Hi everybody,

We are providing Shared webhosting services on Apache webserver and PHP5 and Mysql+Postgres and we have a problem --A big security one!.

 

Our problem is related to php safe_mod, if I disable (off) this mod, every user can execude what they want or she can use some sort of shell programs like (php_shell) and in other hand our customers need safe_mod for some applications like OSCommerce, Self made  Applications and so on, Now:

 

"How Can I enable safe_mod but restrict users to run system commands through PHP or installling malicious application like php_shell that can be harmful for other users on shared host?"

[wildteen88]

You can setup PHP to disable certain functions/classes which will prevent users from using these function in thier scripts.

 

; This directive allows you to disable certain functions for security reasons.

; It receives a comma-delimited list of function names. This directive is

; *NOT* affected by whether Safe Mode is turned On or Off.

disable_functions =

 

; This directive allows you to disable certain classes for security reasons.

; It receives a comma-delimited list of class names. This directive is

; *NOT* affected by whether Safe Mode is turned On or Off.

disable_classes =

[ozux]

Thanks, It's useful.

 

and other thing: Is it possible to log every file access by php? I want to create a log in my server that shows me which Virtual Host executes which php file. Now we have session logging  with "session.save_path" variable but it just logs the Sessions activities.

 

[trq]

These logs should automatically be created by apache by default. take a look at the CustomLog directive to narrow down your logging to more relevent information.

[steviewdr]

You should really be using something like suPHP.

 

As for logging, you could do a auto_prepend file to log some extra info.

 

-steve

[ozux]

It's appear I found my solution. I'm giong to test it 

[ozux]

And one thing more:

I can see every file with include(/file);

for example :

  include("/var/www/.htpasswd");

 

what is the solution for this?