1

I run few PHP webpages with NGINX and PHP-FPM. Recently I hosted site for friend who had security issues with WordPress, did all upgrades, WP and Plugins.

But somehow I found out today that user under which his site is run in PHP-FPM is running system commands e.g. /usr/bin/host
I did not found any overwritten files, and running commands is disabled in php.ini for php-fpm.

  1. Is there any way to find how commands are run, are they run directly by PHP process, or there is some script on server that is executed?

  2. Can I limit commands to which user have access?

  3. Good books/articles on Linux server security where I can search for more info?

Server is running up to date Ubuntu LTS 14.04, with Ubuntu version of NGINX and PHP.

  • You might get more answer in "information security", try there. – YoMismo Oct 5 '15 at 10:40
0

Can I limit commands to which user have access?

Yes, you can, by expanding the disable_functions parameter in your php.ini file (location depends on your setup, e.g. /etc/php5/cgi/php/ini)

disable_functions = system,exec,shell_exec,escapeshellcmd,show_source,leak,ini_restore,pfsockopen,popen,eproc_c,posix_kill,posix_setuid,posix_setpgid,posix_setsid,proc_open,proc_terminate,proc_get_status,proc_nice,proc_close,passthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority
  • Yes, that is true for PHP script and I use that option. But I also had situation where atacker uploaded Perl script in upload bug in PHP script and than executed it (don't know how exactcly). And in situation like that I would like to prevent that user from using commands like ping, or curl etc. – Grzegorz Doleczek Oct 6 '15 at 11:30
  • Lol, ok so the question you posted is broader than I understood first. You are not only concerned about PHP command but also about shell commands. You can configure /bin/false as shell for www-data in /etc/passwd or use suPHP, so the programs run as other users so you have more possibilities to restrict their access. – sebix Oct 6 '15 at 13:11
  • @sebix, most probably if someone has reached the point of executing shell commands from the web he hasn't logged in, thus the shell the user has in /etc/passwd is not executed and has no effect at this stage, although it is a good security measure if that user never has to be logged in to the system. – YoMismo Oct 7 '15 at 8:04
  • Ok, I did what @sebix suggested and now I'm waiting for next atacker to test this on next attack. – Grzegorz Doleczek Oct 7 '15 at 8:24
  • @YoMismo Yes there's much more involved in hardening a server, this question is very broad. – sebix Oct 7 '15 at 13:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.