RE: [PHP-INST] Blatant PHP security issues!!!!

>For instance, PHP scripts have to be world readable. Which >means that anyone who hard coded in a username and password to their mysql >database are putting their database at risk. Actually, is possible to restrict permissions. I have my permissions on some PHP scripts set to 700,750, 600 and 640 depending on whether or not they need execute permissions. How do you have your web server setup? If you create a user id and group id that actually doesn't have any login abilities and is used only by the web server (apache, netscape, etc.) to execute as. Then, set the permissions and ownerships accordingly. If you want one user to be able to execute another users scripts, then they need to have the appropriate permissions to do so. >One other thing I've >noticed is that in order for PHP to write to a text file, that text file has >to be world writeable and world readable. That's crazy. Again, I write text files out all of the time and I have the permissions set 600. The only time I've had to give world readable permissions to a file is when I am using LOAD_FILE in mysql. As to mysql, you shouldn't be hard coding passwords into your PHP scripts and passwords that are stored in the mysql database should be encrypted. Like the web server, mysql should be executing as its own user and group. True, security on a web environment requires some thought and careful configuration and it is easy overlook something critical. But it is possible to make your system "reasonably secure". Am I missing something? Dean -----Original Message----- From: Matthew Toledo [mailto:mtoledo@frognet.net] Sent: Wednesday, February 21, 2001 8:44 AM To: php-install@lists.php.net Subject: [PHP-INST] Blatant PHP security issues!!!! I recently just started using PHP. While it is easy to use, their are some very frightening security issues that I can't believe more people aren't complaining about. Security issues that should scare any sane programmer from using PHP. For instance, PHP scripts have to be world readable. Which means that anyone who hard coded in a username and password to their mysql database are putting their database at risk. Any other user with an account on the system can has the ability to read another person's PHP source. They could then gain access to their MySQL account. Even dumb hackers can do this exploit. One other thing I've noticed is that in order for PHP to write to a text file, that text file has to be world writeable and world readable. That's crazy. I do not want my PHP pages to be world readable. I would like SuEXEC to work with PHP like it does for PERL. I have looked around the web and have yet to find a good tutorial on how to enable SuEXEC to work with PHP. I think it would benefit the PHP community if someone could come up with a clear, concise, easy to read tutorial explaining how to do this. The link to this tutorial, when it is written, should be plastered on every PHP site on the web.... or does such a tutorial exist already? Please let me know if a tutorial like the one I described above exists. ========================= Matthew Toledo Athens Musician Network amn@frognet.net http://music.athens.oh.us -- PHP Install Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-install-unsubscribe@lists.php.net For additional commands, e-mail: php-install-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net