I run few PHP webpages with NGINX and PHP-FPM. Recently I hosted site for friend who had security issues with WordPress, did all upgrades, WP and Plugins.

But somehow I found out today that user under which his site is run in PHP-FPM is running system commands e.g. /usr/bin/host
I did not found any overwritten files, and running commands is disabled in php.ini for php-fpm.

  1. Is there any way to find how commands are run, are they run directly by PHP process, or there is some script on server that is executed?

  2. Can I limit commands to which user have access?

  3. Good books/articles on Linux server security where I can search for more info?

Server is running up to date Ubuntu LTS 14.04, with Ubuntu version of NGINX and PHP.

  • You might get more answer in "information security", try there.
    – YoMismo
    Oct 5, 2015 at 10:40

1 Answer 1


Can I limit commands to which user have access?

Yes, you can, by expanding the disable_functions parameter in your php.ini file (location depends on your setup, e.g. /etc/php5/cgi/php/ini)

disable_functions = system,exec,shell_exec,escapeshellcmd,show_source,leak,ini_restore,pfsockopen,popen,eproc_c,posix_kill,posix_setuid,posix_setpgid,posix_setsid,proc_open,proc_terminate,proc_get_status,proc_nice,proc_close,passthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority
  • Yes, that is true for PHP script and I use that option. But I also had situation where atacker uploaded Perl script in upload bug in PHP script and than executed it (don't know how exactcly). And in situation like that I would like to prevent that user from using commands like ping, or curl etc. Oct 6, 2015 at 11:30
  • Lol, ok so the question you posted is broader than I understood first. You are not only concerned about PHP command but also about shell commands. You can configure /bin/false as shell for www-data in /etc/passwd or use suPHP, so the programs run as other users so you have more possibilities to restrict their access.
    – sebix
    Oct 6, 2015 at 13:11
  • @sebix, most probably if someone has reached the point of executing shell commands from the web he hasn't logged in, thus the shell the user has in /etc/passwd is not executed and has no effect at this stage, although it is a good security measure if that user never has to be logged in to the system.
    – YoMismo
    Oct 7, 2015 at 8:04
  • Ok, I did what @sebix suggested and now I'm waiting for next atacker to test this on next attack. Oct 7, 2015 at 8:24
  • @YoMismo Yes there's much more involved in hardening a server, this question is very broad.
    – sebix
    Oct 7, 2015 at 13:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .