lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <001001c3676f$7d773120$2101a8c0@speedy>
From: mnsan11 at earthlink.net (Elvedin)
Subject: more on securing php

Sounds to me like he shouldn't be running a web server at all. If he doesn't
know what he's doing, (or he wants IIS as a web server) that just shows he's
not trustworthy or credible. Did you mention something about a web hosting
company? My best advice is to tell him to forget about it.

----- Original Message -----
From: "Justin Shin" <zorkshin@...pabay.rr.com>
To: "Full-Disclosure@...ts.Netsys.Com" <full-disclosure@...ts.netsys.com>
Sent: Wednesday, August 20, 2003 4:58 PM
Subject: [Full-Disclosure] more on securing php


> Hi guys (sorry for the late response but I'm not really supposed to worry
about this stuff at work ya know :) --
>
> Thanks for all your responses. I already knew he shouldn;t be running
apache as root, I have told him before to run apache as a seperate user (eg.
"apache") but he has yet to fix this.
>
> Once again, the safe_mode on PHP works __directly with the *nix kernel__ ,
meaning that it makes sure that resources accessed are owned by the
currentuser. However, if PHP is called by apache, which runs as root, and if
root owns everything ... I think ya get the picture. :) That was my dillema
before.
>
> Now about IIS. I have told him to run *nix but he is stubborn as a, umm,
donkey when it comes to this stuff. He refuses to touch it, so I told him
apache on Windows. I simply do not *trust* IIS as a stable and secure
webserver. At least apache is secure (to a certain degree).
>
> Also, I have thought maybe he could crate a seperate 2k3 user account per
each new user, but then I don't know if safe_mode works with Windows user
accounts.
>
> So, basically, he shouldn't really be running apache on windows w/ php at
all, right?
>
> Thanks
>
> -- Justin
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ