PHP and Security

cbox · 12-23-2009, 01:04 AM

Hi,

How are ISPmanager configured regarding PHP and security?

I can see that it supports mod_php, cgi and fastcgi. But how about safe_mode and open_basedir configuration?

Is it by default safe to use, or should there be additional php.ini configurations to make it safe enough? I think about disable functions etc.

Best regards
Sylvester Nielsen

slava · 12-23-2009, 09:54 PM

You can disable some functions and enable php safe mode in the global php.ini (for example in /etc/php/php.ini).
open_basedir by default configured for mod_php for user home directory in the apache configuration when you create www domain via ISPmanager

Also you can change default parameters for new users in the ISPmanager configuration file.

All parameters are safe for using in the default configuration and ready for web-hosting service.

sara145 · 12-24-2009, 11:41 AM

I had the same problem

cbox · 12-26-2009, 01:20 PM

I just installed ISPmanager on a server and did a few tests.
I was able to do a cat /etc/passwd from the webhotel, which is not so good.

But i will do some more testing, and hopefully it turns out good.

12-23-2009, 01:04 AM	#1
cbox Junior Member Join Date: Dec 2009 Posts: 8	PHP and Security Hi, How are ISPmanager configured regarding PHP and security? I can see that it supports mod_php, cgi and fastcgi. But how about safe_mode and open_basedir configuration? Is it by default safe to use, or should there be additional php.ini configurations to make it safe enough? I think about disable functions etc. Best regards Sylvester Nielsen

12-23-2009, 09:54 PM	#2
slava ISPsystem team Join Date: May 2008 Location: ISPsystem Posts: 588	You can disable some functions and enable php safe mode in the global php.ini (for example in /etc/php/php.ini). open_basedir by default configured for mod_php for user home directory in the apache configuration when you create www domain via ISPmanager Also you can change default parameters for new users in the ISPmanager configuration file. All parameters are safe for using in the default configuration and ready for web-hosting service. Last edited by tanya; 12-30-2009 at 03:57 AM.