PHP safe_mode=off

Web page creation, programs, scripts, PHP, SQL?

Moderator: Moderators

Postby zoli » Sun Feb 29, 2004 2:10 am

hi,

I assume, that it is a general wish to disable PHP safe_mode=on.

It is important to understad that PHP, as a command interpreter usually runs as a web server user and not as a home page user, therefore there is a high security risk to abuse this behaviour. Therefore PHP has a special option - safe_mode that assure that home page user access just files with own UID/GID and lot of file and system functions are disbaled because of web server access rights.

Moreover there is a problem with some normal (not safe_moded) functions as mail() and some socket functions that can be extremelly powerful in malitious user's hand.

As a first stage, I implemented a patch that allowed mail and other disabled functions just for shell/registered users

... and now I a proud to announce that solution that allows safe mode to be turned off without security violations, is ready.
It is not a revolutionary solution but it does work and polarhome users might have a possibility to enjoy full power of PHP (if we vote so).

For test purpose this solution is installed just on freebsd server and after one week testing I plan to patch all other systems that supports PHP.
Regards,
Z
---
Zoltan Arpadffy
zoli
Forum Admin
Forum Admin
 
Posts: 756
Joined: Mon Sep 30, 2002 1:27 am
Location: Stockholm, Sweden

Postby DenisF » Sun Feb 29, 2004 2:50 am

wow :o

That's.......wow... :o
*shocked*
I never thought id'e live up to see this happen.. not even to shell-only users..
Well done Z, Well done.

Though with these new settings (mail and safemode), id'e recommend to tight-up the shell forms, add certain criteria to it..
Recon we will have a whole new wave of people who will gladly abuse those low-cost features :(
Image
[ FAQ ] :: [ Policy ] :: [ Port Forwarding Guide ] :: [ Search ]
User avatar
DenisF
Forum Admin
Forum Admin
 
Posts: 679
Joined: Mon Dec 16, 2002 9:09 pm
Location: Israhell

Postby zoli » Mon Mar 01, 2004 12:56 am

Denis,

> Recon we will have a whole new wave of people who will gladly abuse those low-cost features

I do not think so... safe mode is turned off, but users run under their own UID/GID and our solution is more picky on that than safe mode, but if UID/GID is satisfied it allows full PHP power - except mail and other socket functions - they still requires registration.
Regards,
Z
---
Zoltan Arpadffy
zoli
Forum Admin
Forum Admin
 
Posts: 756
Joined: Mon Sep 30, 2002 1:27 am
Location: Stockholm, Sweden

Postby DenisF » Mon Mar 01, 2004 2:33 am

I hope you're right..

This -is- a good solution to bring more shell users, on that i agree, but on the other hand it can bring some people who can spare those 2~5$ just to put a mass-emailer script or .. erm.. something of that sort.

Alas, we'll just have to see :)
PS
will this be implemented on redhat?
Image
[ FAQ ] :: [ Policy ] :: [ Port Forwarding Guide ] :: [ Search ]
User avatar
DenisF
Forum Admin
Forum Admin
 
Posts: 679
Joined: Mon Dec 16, 2002 9:09 pm
Location: Israhell

Postby zoli » Mon Mar 01, 2004 3:10 am

hi,

yes, I planned to implement on every system that runs PHP.

... I know that there is a problem with lot of "cheap" registrations on redhat - but it would not be fair against other registered users.
Regards,
Z
---
Zoltan Arpadffy
zoli
Forum Admin
Forum Admin
 
Posts: 756
Joined: Mon Sep 30, 2002 1:27 am
Location: Stockholm, Sweden

Postby sjaz » Mon Mar 01, 2004 10:24 am

Indeed, the AUP for polarhome probably(or should contain) information pertaining to the deletion of account for spam abuse.

Wonder if its possible to lock down safe mode so all mail comes from username@polarhome.com so they cant spoof in the from field...
User avatar
sjaz
Forum Admin
Forum Admin
 
Posts: 689
Joined: Fri Feb 14, 2003 11:08 pm
Location: London, UK

Postby zoli » Mon Mar 01, 2004 5:16 pm

Only mail.polarhome.com has full spam and virus control.

Unfortunately outgoing mail (originated from hosts) may use local smtp server... but in near future I'll configure "smarthost" feature on polarhome hosts that forces every (both in and outgoing) mail to pass mail.polarhome.com filtering out spam and viruses.
Regards,
Z
---
Zoltan Arpadffy
zoli
Forum Admin
Forum Admin
 
Posts: 756
Joined: Mon Sep 30, 2002 1:27 am
Location: Stockholm, Sweden

Postby zoli » Thu Mar 04, 2004 1:02 am

so.... ?
Do you want such solution that freebsd runs now on not?
Regards,
Z
---
Zoltan Arpadffy
zoli
Forum Admin
Forum Admin
 
Posts: 756
Joined: Mon Sep 30, 2002 1:27 am
Location: Stockholm, Sweden

Postby DenisF » Thu Mar 04, 2004 2:27 am

Shall polarhome disable PHP safe_mode? (it is enabled now)
Yes  54.67 % (82)
No  31.33 % (47)
I don't use PHP  6.00 % (9)
No opinion  8.00 % (12)
Total votes: 150


Looks like i'm not the only one who can't make up his mind :(
Image
[ FAQ ] :: [ Policy ] :: [ Port Forwarding Guide ] :: [ Search ]
User avatar
DenisF
Forum Admin
Forum Admin
 
Posts: 679
Joined: Mon Dec 16, 2002 9:09 pm
Location: Israhell

Postby zoli » Mon Mar 22, 2004 2:11 am

hi,

seems this FreeBSD test of PHP safe_mode=off was not a success story, not because safe mode did not work, but PHP did not work as it should for 80% of users. It required very strict permissions and ownership on the file, that users in most cases, could not satisfy.

I am shame to say that I fixed the problem while I drunk a beer or two. I could do it much earlier.
It should work better now... please re-evaluate.

If you like this solution it will be implemented on all hosts including redhat.

In short:
php safe mode off for all users
cgi just for shell/registered users
mail and other socket functions just for shell users
Regards,
Z
---
Zoltan Arpadffy
zoli
Forum Admin
Forum Admin
 
Posts: 756
Joined: Mon Sep 30, 2002 1:27 am
Location: Stockholm, Sweden

Postby DenisF » Mon Mar 22, 2004 2:19 am

A beer never killed anyone zoli ;)

I'll look into it :)

BTW
freebsd seems to have some quotas problem
denisf@freebsd$ quota -v denisf
quota: /home/quota.user: Permission denied
Disk quotas for user denisf (uid 5483): none


EDIT
Iv'e checked some apps that need the safemode off, works like a charm :)
Tried installing phpBB2, but i get an internal server error at step2 of installation :(
Image
[ FAQ ] :: [ Policy ] :: [ Port Forwarding Guide ] :: [ Search ]
User avatar
DenisF
Forum Admin
Forum Admin
 
Posts: 679
Joined: Mon Dec 16, 2002 9:09 pm
Location: Israhell

Postby sjaz » Mon Mar 22, 2004 12:51 pm

Yeah, I mentioned the quota thing before on FreeBSD, and as for the beer Zoli its good :)
User avatar
sjaz
Forum Admin
Forum Admin
 
Posts: 689
Joined: Fri Feb 14, 2003 11:08 pm
Location: London, UK

Postby zoli » Wed Mar 24, 2004 11:20 pm

quota file was corrupt.
now it should be ok.
Regards,
Z
---
Zoltan Arpadffy
zoli
Forum Admin
Forum Admin
 
Posts: 756
Joined: Mon Sep 30, 2002 1:27 am
Location: Stockholm, Sweden

Postby sjaz » Thu Mar 25, 2004 11:29 am

Yep, perfect :)
User avatar
sjaz
Forum Admin
Forum Admin
 
Posts: 689
Joined: Fri Feb 14, 2003 11:08 pm
Location: London, UK

Postby locke » Wed Jul 21, 2004 5:04 am

What happened about this? I've noticed that safe mode is still turned on.
locke
 

Postby sjaz » Wed Jul 21, 2004 8:53 am

In future it would be easier if you outlined your username and what server your on.
User avatar
sjaz
Forum Admin
Forum Admin
 
Posts: 689
Joined: Fri Feb 14, 2003 11:08 pm
Location: London, UK

Postby DenisF » Fri Jul 23, 2004 2:01 pm

I came up with a really nice solution that will keep both the users and the system happy, it is currently being reviewed by Z and should it pass the QA test - it will come to a server near you very soon :)

[For the impatient; you can register an account on mandrake and try it right now, free of charge ;)]
Image
[ FAQ ] :: [ Policy ] :: [ Port Forwarding Guide ] :: [ Search ]
User avatar
DenisF
Forum Admin
Forum Admin
 
Posts: 679
Joined: Mon Dec 16, 2002 9:09 pm
Location: Israhell

Postby maorl » Sun Aug 22, 2004 9:58 am

Can you watch the poll now?
Shall polarhome disable PHP safe_mode? (it is enabled now)
Yes  54.31 % (1122)
No  35.24 % (728)
I don't use PHP  4.70 % (97)
No opinion  5.76 % (119)
Total votes: 2066

So are tou going to disable the safe_mod or not??
maorl
 

Postby DenisF » Sun Aug 22, 2004 10:31 am

pro = 54.31%
con = 45.69%

doesn't look like safe mode bothers anyone really.
Image
[ FAQ ] :: [ Policy ] :: [ Port Forwarding Guide ] :: [ Search ]
User avatar
DenisF
Forum Admin
Forum Admin
 
Posts: 679
Joined: Mon Dec 16, 2002 9:09 pm
Location: Israhell

Postby maorl » Mon Aug 23, 2004 2:38 pm

I'll tell you my problem with this "Safe_Mod".. I have a forum hosted here. When someone want to send an E Mail from my forum he just can't use this function because your safe mod don't let the mail function work... My forum's system is IBHEB(Invision Board Hebrew)...
maorl
 

Next

Return to Web development

Who is online

Users browsing this forum: No registered users and 3 guests

cron