full-disclosure - more on securing php

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20030821012413.GC1232@mail.braingia.org>
From: fd at braingia.org (Steve Suehring)
Subject: more on securing php

IIS in Windows Server 2003 has been rearchitected and might be worth a 
look.  If this is for a shared hosting environment, users will probably 
want IIS.  You probably should really try to convince your friend to run 
Apache in Linux regardless.

Here's some articles on IIS 6 from Microsoft.

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/proddocs/standard/iiswelcome.asp
http://www.microsoft.com/windowsserver2003/techinfo/overview/iisenhance.mspx
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/plan/appisoa.asp


Steve

On Wed, Aug 20, 2003 at 05:58:04PM -0400, Justin Shin wrote:
> Hi guys (sorry for the late response but I'm not really supposed to worry about this stuff at work ya know :) --
> 
> Thanks for all your responses. I already knew he shouldn;t be running apache as root, I have told him before to run apache as a seperate user (eg. "apache") but he has yet to fix this.
> 
> Once again, the safe_mode on PHP works __directly with the *nix kernel__ , meaning that it makes sure that resources accessed are owned by the currentuser. However, if PHP is called by apache, which runs as root, and if root owns everything ... I think ya get the picture. :) That was my dillema before.
> 
> Now about IIS. I have told him to run *nix but he is stubborn as a, umm, donkey when it comes to this stuff. He refuses to touch it, so I told him apache on Windows. I simply do not *trust* IIS as a stable and secure webserver. At least apache is secure (to a certain degree).
> 
> Also, I have thought maybe he could crate a seperate 2k3 user account per each new user, but then I don't know if safe_mode works with Windows user accounts.
> 
> So, basically, he shouldn't really be running apache on windows w/ php at all, right?
> 
> Thanks
> 
> -- Justin
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html