On Thu, 4 Oct 2007, Ben Mohilef wrote:
After setting up a secure Apache (irrespective of the distribution) a lot of
admins go get a "php-this" or "php-that" web program from a repository.
Unfortunately, they don't ask the question of how this thing will be
automagically updated each time a vulnerability is fixed, so the program
never gets updated.
So so so correct...some basic policies would be to...
1. always run hosts with own user and apache group, set up vhost dirs
permissions accordingly for this
2. always use suexec
3. if possible run php as a cgi
4. lock down php for example:
- open_basedir =/var/www:/var/tmp:/tmp:/usr/local/lib/php
- disable_functions = exec, shell_exec, system, virtual, show_source,
readfile, passthru, escapeshellcmd, popen, pclose, phpinfo
- disable safe_mode
4a. (if tehy say their scripts need access to bin like for uptime etc tell
em to get a better script)
4b. (make absolutely NO exemptions to the lockdowns)
5. never install vhost sites special programs that need root in any way
shape or form
6. use a respected server OS, one that doesnt hack the f#ck out of
programs like RH(CentOS) do
6a. use modern current packages of apache2, php5 and MySQL,Sendmail etc
from the respective sites, and not by use of RPM's because its too
"vendor altered" which is where 90% of the security issues come into
it.
7. ban use of any but most current version of phpnuke (ban totally if you
can) and those frickin image gallery programs.
8. use a decent detection system
9. use something like MailScanner with spamassassin adn a good anti-virus
on your mail server to minimise the exploit opening in the first place
10, follow same rules as you would on winblow$, no running stuff you dont
know what it is, no clicking on links in mesgs you dont know the
sender, its all basic sence :)
--
Cheers
Res
Slackware -V- sloooUbuntoooou
http://lxer.com/module/newswire/view/93393/
