The security hole of PHP
On most Apache servers, PHP runs as an Apache module. As such, it runs directly in the user nobody, but doesn't require the execute flag.
This means that in order to execute a PHP file, it simply needs to be world readable.
The problem is that this allows every other users on the server to read your PHP files !
Allowing other users to read your HTML files is not a problem, since they can be displayed in Internet Explorer. However, PHP files are not readable, they are parsed.
Many scripts use a PHP file to store a database username and password. This means that on another server every client could read your PHP files, retrieve your password and access your databases.
At Cablan.net we closed this hole
We did so by installing a module called PHPsuexec, which executes PHP scripts under your username.
As such, instead of using everyone's permissions it uses the owner's permissions.
You can thus change the permissions of your PHP scripts to : 0700 or 0400 and still be able to read and execute them. However, these scripts will no longer be accessible to any other users.
In fact, PHPsuexec will refuse to execute a script if it is world-writtable to protect you from someone abusing one of your scripts.
Table to illegal / required rights
|
read |
write |
execute |
owner |
|
to write |
|
group |
|
|
|
everyone |
|
|
|
As you can see, the only required permission is owner-read (0400), but if you need to write to that file, you need to also enable the owner-write permission ( 0600 ).
Cablan.net recommands all your PHP files to have either permission 0400 or 0600.
The execute permission is never required, and the group and everyone permissions can be left to 0.
Directories
To add complexity to the issue, PHPsuexec, also validates the directories in which PHP files are located.
- A PHP file cannot be executed in a directory that is group-writtable or world-writtable.
However, in order to access a directory, it must be world-executable, which is safe to do. As such, directories containing PHP files should have permissions 0755 or 0555.
Table to illegal / required permissions for directories with PHP files
|
read |
write |
execute |
owner |
|
To Write |
|
group |
|
|
|
everyone |
|
|
|
