1
vote
1answer
250 views

Securest way to authenticate users against /etc/shadow using PHP?

This question became important to me, since I'm setting up a Horde environment and want to use the system accounts. Doing some search I found mainly 4 ways of doing that, which all seem to have some ...
1
vote
1answer
101 views

Preventing script execution and file downloads in a directory?

I have a directory on my website where I'm storing files uploaded by users. I use a whitelist for uploaded file types and also save the files with hashed names, but from what I've read another good ...
1
vote
2answers
485 views

Minimize PHP.CGI.Argument.Injection and further hardening of the Centos 6.4 web server

We have Centos 6.4 server with a physical firewall. We keep seeing quite an number of PHP.CGI.Argument.Injection is detected by the firewall. On the server itself we have done the basic apache ...
2
votes
1answer
594 views

How to execute php file as different user securely?

I want to confirm that my thoughts are correct as this is about security matter. We have web based application which is using db2 database. db2 runs under the db2inst1 user. Now we want users of the ...
2
votes
2answers
209 views

Does PHP exec() store the executed command anywhere?

Suppose I have the following code in a PHP web application. $encrypt ? $password = generatePassword($passwordstrength): $password=""; $estring = "7z a -p$password -mx0 packFoo.aes.7z mydir/foo"; ...
0
votes
2answers
396 views

How do I make PHP securely load files from the server root home folder on CentOS?

So I built what I thought would be this awesome reporting page in PHP that loads data from some CSV text files and creates nice Google charts and tables for our clients. I then thought it would be ...
4
votes
2answers
493 views

How to set secure permissions for multiple users and multiple websites?

On a Gentoo 3.2.12 server with apache2+php, there are several websites running: /www /website1 /website2 ...etc The apache user should have read-only access to all the websites. There ...
10
votes
2answers
33k views

What user should apache and PHP be running as? What permissions should /var/www files have?

I just spun up an Ubuntu 11.10 box and then ran apt-get install apache2 php5 to install apache2 and PHP 5 on the box. Now it is functioning as a "web server" and it loads the "It Works!" page. Now I'm ...
7
votes
1answer
473 views

Opening port 80 but remain secure

I have a standard installation of Ubuntu 10.04, and have installed the LAMP stack so I can do some web development locally. On my router I have opened port 80 so I can develop with external services ...