I have a project requirement, Where I have to check the integrity of each PHP files before executing it using md5 or some method. The hash value is stored safely within the server.

What I have done: I have used the auto_prepend_file feature and I am able to check the hash value of each file executed, But auto-prepend-file works only for the very first file executed, not the files executed using include_once or using function call.

What is the way to check all the files before executing. I am using lighthhtpd on linux OS.

  • 1
    if you're worried about attackers overwriting your PHP scripts via the httpd, then change the ownership and perms so that the httpd can read & execute but NOT write the .php files. upload them via scp or something as the owning uid. web scripts should never be writable by the uid running the httpd. – cas Aug 21 '19 at 11:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.