Re: Deny Access To configuration file using php scripts
David Morel <[email protected]>
| Newsgroups | gmane.comp.security.linux |
|---|---|
| Message-ID | <[email protected]> |
Le Mardi 1 Mars 2005 18:54, raT a écrit :
> the first thing they do is a
> system ('cat /var/www/path to config file');
> inside a php script
use php safe_mode, run php scripts in suexec.
> my problem is to deny this file from being read throu the script since
> the apache deamon runs as nobody
you can have multiple virtual hosts running under their own uid/gid -see
virtual host configuration and suexec doc for apache
> and it has to have read permision to the configuration file.
>
> my users have shell acount
they shouldn't ! What do you expect ? Do they really have to have a shell
account ???
--
+---------------------------------------+
| David Morel <[email protected]> |
| OpenPGP public key : |
| http://www.amakuru.net/dmorel.asc |
+---------------------------------------+
signature.asc
(application/pgp-signature, 189 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQBCJL7Aqr7QF98duCMRAq7oAKCN/P7uJAuOOf1VgSZEUrn6GF+o1QCfd1Vd rCkICyB9Oce7iEXbdNk73cY= =C9sT -----END PGP SIGNATURE-----