lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: smp.repicky at gmail.com (Matt)
Subject: How secure is PHP ?

> I think one thing worth mentioning is that in
> *most* PHP installations, the PHP code will be
> executed as the web server user.
> 
> This means that the several hundred IT students
> will be able to read each other's code and write
> to each other's datastores. Most students will
> have to chmod a+w any files or directories
> that will be modified by their PHP code.
> 
> There are several ways around this, but it does
> take more configuration and security smarts to
> implement. This "vulnerability" (if you can call
> it that) exists in just about every multi-user web
> system out there, so it's probably worth your time
> to investigate different security mechanisms.

There is actually a very easy way around this.  If you are running an
LDAP or AD environment, you can use the LDAP to authenticate the
users, then once the user is authenticated, take the username and
store that into a variable which you can then use to chown and chgrp
the resulting files for that user after they are written.

Doesn't take much to execute a connect() to an LDAP server, mb like 10
lines to make it nice and clean?  Haven't written one in a while.  But
I know when I was writing PHP code to connect to Oracle systems a few
years ago I was tasked to authenticate with an LDAP server before
allowing access to the backend database.

--


Powered by blists - more mailing lists