Disable shell command from PHP for all domains?

[j Zim]

It seems that a customer was able to upload a php file into the /tmp directory and then call a sh command (php <name of its file.php>) to execute the script.

At the moment I have no idea from what domain this is done but as a quick fix I would like to disable the possibility to execute sh/shell command for all my customers using PHP script.

Is that possible changing the php5.ini file (disable_functions) or doing it this way I'll have some trouble with Plesk or other admin script (like phpmyadmin, etc.)?

Thanks in advance for your help.
JZ

 

[Amin Taheri]

No that should be fine - plesk uses its own php.ini file for its own web processes, so it should be safe to turn it off.

This is what I use in my disable functions

disable_functions = dl , exec , passthru , pcntl_exec , popen , posix_kill , posix_mkfifo , posix_setuid , proc_close , proc_open , proc_terminate , shell_exec , system , ftp_exec , leak , posix_setpgid , posix_setsid , proc_get_status , proc_nice , show_source , escapeshellcmd

Also its a good idea to set these
expose_php = off
enable_dl = Off
allow_url_include = off

 

[j Zim]

Hi Amin, thanks for your reply, I've added this config but I got a call from a customer using webmail (horde) and he was not able to send email anymore (error with sendmail which is using popen). So I remove popen from the "disable_functions" config, do you think it's ok this way?
Cheers,
JZ

 

[Amin Taheri]

Should be ok yeah - I dont use webmail on the same server as plesk runs as so I have mine disabled - you may also want to think about using safe_mode (if your using an older than 5.3 version of php) and open base dir restrictions as well if your not already.

 

[Amin Taheri]

Actually it looks like a word arround was posted here
http://forum.parallels.com/showpost.php?p=453749&postcount=9

1) Change $conf['mailer']['type'] from 'sendmail' to 'smtp'
2) Add the following line:
$conf['mailer']['params']['host'] = 'localhost';

In this way, horde will use SMTP and no longer needs popen to be enabled.

Then you can leave popen disabled.