Protection against readfile

[daride]

Hello there,

I stumbled upon this by a friend of mine,
he was able to see every php file's source.

I already tryd some protection with the open_basedir
however everything i tryd it doesn't work.

Script on my server to check it:
http://www.starhosted.com/hierzo.php

Can anywone help me or maybe secure me against this? (i have ssh access)

 

[sullise]

Just add readfile to the deny list in php.ini and restart httpd.

 

[daride]

I did that...doesn't work.

I'm running a debian server atm, could you tell me else where the exact location of my php.ini is?

 

[daride]

Also I don't think it's very smart to add it to the deny list, because it's something that's much used in PHP.

I tought it was a problem with the open_basedir restrictions.
anywone got a idea or a fix?

 

[sullise]

Is safe mode on?

 

[The_cobra666]

Is safe mode on?

I think it is ==>

Warning: shell_exec(): Cannot execute using backquotes in Safe Mode in /home/admin/domains/starhosted.com/public_html/hierzo.php on line 2

Warning: shell_exec(): Cannot execute using backquotes in Safe Mode in /home/admin/domains/starhosted.com/public_html/hierzo.php on line 11

 

[daride]

It is on....

else see my phpinfo

http://83.98.182.214/phpinfo.php

 

[daride]

Strange my phpinfo says it off...however it is on

 

[sullise]

You using suPHP?

 

[daride]

You using suPHP?

nope, never heard of it.
what does it do, and what are the benefits of it?

 

[nobaloney]

Does it work across sites?

In my test on your site a moment ago I couldn't read /etc/passwd, which IS a world-readable file.

Jeff

 

[sullise]

I think I understand the situation now.

Readfile will be able to view any file under your /home/username directory if it's readable, but shouldn't be able to read anything above that.

Shouldn't be able to read anybody elses /home/username site files.

You can't (or shouldn't) disable it because it's used by a lot of scripts.

 

[daride]

I think I understand the situation now.

Readfile will be able to view any file under your /home/username directory if it's readable, but shouldn't be able to read anything above that.

Shouldn't be able to read anybody elses /home/username site files.

You can't (or shouldn't) disable it because it's used by a lot of scripts.

Your 100% correct!!
Couldn't type it better (maybe that is because i'm dutch )

So i hope somewone can help me out of this because it's REALLY getting annoying.

 

[nobaloney]

daride, your phpinfo screen says safe_mode is on.

Is that what you want?

Is it on?

Don't forget it can be controlled site by site.

Jeff

 

[daride]

daride, your phpinfo screen says safe_mode is on.

Is that what you want?

Is it on?

Don't forget it can be controlled site by site.

Jeff

I just wan't a safe invirement for my users to run there website in...

I switched safe_mode on because somewone sayd it would fix my problem, however it didn't...

if some linux (debian) or directadmin expert is willing to fix it for me...contact me i'll give you SSH acces.

 

[sullise]

I'm still not fully getting what the problem is. Are you running a "free" hosting account under a single shared hosting accout?

 

[daride]

I'm still not fully getting what the problem is. Are you running a "free" hosting account under a single shared hosting accout?

I'm running my own dedicated server wich is for an hosting compagny called starhosted....

The problem is that other users can read every other user his file.

 

[nobaloney]

If safe_mode is on they shouldn't be able to do that.

Please be more clear; give us a complete scenario of exactly what user A does to read user B's site.

Jeff