RE: [PHP4BETA] cat /etc/passwd
| From: | Mike Robinson | Date: | Wed, 12 Apr 2000 12:49:00 +0000 |
| Subject: | RE: [PHP4BETA] cat /etc/passwd | ||
| References: | 1 | Groups: | php.version4 |
| Request: | Send a blank email to php-version4+get-13444@lists.php.net to get a copy of this message | ||
> On 11 Apr, Ben-Nes Michael wrote:
> > Hi All
> >
> > php4 as module on apache 1.3.12 linux
> >
> > how can I prevent
> > echo
cat /etc/passwd;
> >
>
> See the information in /manual/html/security.html at your favourite PHP
> mirror
Of course, reading the security chapter of the php manual is always a good
idea, but the security revolving around the module version of php is a
little different than the cgi.
The entire module portion of the security info looks like:
"Apache module
When PHP is used as an Apache module it inherits Apache's user permissions
(typically those of the "nobody" user)."
/etc/passwd is readable by the user nobody (and just about every other
user).
So, as opposed to this being a php security issue, it becomes an OS/admin
security issue.
Have a look at shadow passwords, passwd+, and your password philosophy.
Mike