note 3433 deleted from install.apache by imajes

Ok. I went ahead and did the usual SysAdmin thing and tested everything out that everyone mentioned here. IMO the best and simplest way to tighten up this lil security threat is this way: 1. Edit httpd.conf so that apache runs as a non-root UID. I use UID 'nobody' 2. Edit php.ini (using php-4b3) so that safe mode is on and that userland is "./" (I tested this from the erik.hellman@apollo.nu from above) 3. For safe measures edit the variable further down in php.ini called user_dir. Its not clear to me how well this works yet but I thought I would throw this in because it may help at some point. I configured my settings as mentioned above and attempted to run the include statement mentioned above from a non-root user. This is the message I received... Warning: SAFE MODE Restriction in effect. The script whose uid is 1001 is not allowed to access /etc/passwd owned by uid 0 in /users/notjames/html/test.phtml on line 5 Warning: Failed opening '/etc/passwd' for inclusion (include_path='') in /users/notjames/html/test.phtml on line 5 To me...this says it all as far as a simple web setp is concerned. There may be more complex setups out there that need more attention. Just my $.02