Close Open DNS Servers Published: Mar 16, 2006
  • Rating

    5/5

A lot of sites talk about securing PHP but just refer to different compiling options. I don't care about those, I want to secure php.ini itself so you don't have to recompile PHP to help make it more secure.

Securing PHP

Well PHP is one of the most popular applications that run on Linux and Windows servers today. It's also one of the main sources for servers and user accounts getting compromised. I want to go over some of the things you can do to help lock down PHP, securing php and securing php.ini

First off you want to figure out how you can edit php.ini This is the main configuration file for PHP. You can find it by logging into shell and typing in the following:

# php -i |grep php.ini

Turn on safe_mode


Safe mode is an easy way to lock down the security and functions you can use. PHP.net explains php safe_mode as, "The PHP safe mode is an attempt to solve the shared-server security problem. It is architecturally incorrect to try to solve this problem at the PHP level, but since the alternatives at the web server and OS levels aren't very realistic, many people, especially ISP's, use safe mode for now."

I highly recommend you enable safe_mode on production servers, especially in shared environments. This will stop exec functions and others that can easily prevent a security breach.

See our article on Customizing PHP Safe Mode


Disable Dangerous PHP Functions

PHP has a lot of potential to mess up your server and hack user accounts and even get root. I've seen many times where users use an insecure PHP script as an entry point to a server to start unleashing dangerous commands and taking control.

Search the php.ini file for:
disable_functions =

Add the following:

disable_functions = dl,system,exec,passthru,shell_exec


Turn off Register Globals

Register_globals will inject your scripts with all sorts of variables, like request variables from HTML forms. This coupled with the fact that PHP doesn't require variable initialization means writing insecure code is that much easier.
See http://us2.php.net/register_globals

register_globals = On

Replace it with

register_globals = Off

Run PHP through PHPsuexec Preventing Nobody Access

The biggest problem with PHP is that on cPanel servers is that PHP will run as nobody. When someone sets a script to 777 access that means the nobody user has write access to that file. So if someone on the same shared server wrote a script to search the system for 777 files they could inject anything they wanted, compromising the unsuspecting users account.

PHPsuexec makes PHP run as the user so 777 permissions are not allowed. There are a few downfalls to PHPsuexec but I think it's required on a shared environment for the security of everyone.  Safe_mode doesn't prevent you from compromising other users files. This is where PHPsuexec comes in, it stops the user from being able to read another users files. It also makes it easier for you, the administrator, to track PHP mail function spamming and lots of other issues caused by PHP scripts because now you can easily track it ot the users account responsible.

For this you will need to recompile PHP with suexec. On cPanel /scripts/easyapach has this build in.


I hope this has summed up some of the things you can do to help secure PHP on your server. There's also open_base protection which you can use to prevent users from reading other users files.

About the Author:
Steven Leggett is the editor of the server resource and hosting tutorial site, www.webhostgear.com and specializes in system administration and web development.

  • Rating

    5/5

Related Articles

Comments (20)

  • Gravatar - Jen
    Jen 19:58, March 20, 2006
    If you have multiple servers running off the same DNS, make sure that you put all those server IPs in the trusted area if they are resolving through that DNS:<br />
    <br />
    <pre>acl "trusted" {<br />
    mainIP;secondaryIP;firstserverip;secondserverip;127.0.0.1;<br />
    };</pre><br />
    <br />
    Otherwise, great tutorial.
  • Gravatar - zac
    zac 21:57, March 22, 2006
    actually all you need to do is tihs:<br />
    <br />
    options {<br />
    recursion no;<br />
    };<br />
    <br />
  • Gravatar - Rajesh
    Rajesh 09:42, March 23, 2006
    i did as per the instructions but the "Open DNS Servers" still show fail. please let me what else is to be done.
  • Gravatar - Andrew
    Andrew 20:11, March 23, 2006
    The above breaks Bind on a VPS
  • Gravatar - Rajesh
    Rajesh 10:10, March 29, 2006
    I did as mentioned above but still the "Open DNS Servers" show fail in the DNS stuff.
  • Gravatar - dew
    dew 11:40, April 12, 2006
    really
  • Gravatar - alan
    alan 12:46, April 18, 2006
    this worked as-is for me
  • Gravatar - valtea
    valtea 20:35, April 19, 2006
    My server have <br />
    <br />
    root@server [/etc]# cat named.conf<br />
    include "/etc/rndc.key";<br />
    <br />
    controls {<br />
    inet 127.0.0.1 allow { localhost; } keys { "rndckey"; };<br />
    };<br />
    So where do i Add <br />
    acl "trusted" {<br />
    mainIP;secondaryIP;127.0.0.1;<br />
    };<br />
    Will it be on the same line with the keys after "rndckey"; <here><br />
    or <br />
    "rndckey"; }; <Here><br />
    };
  • Gravatar - Ryan
    Ryan 02:22, May 4, 2006
    Did anyone come up with an answer for valtea or does anyone know? I have been researching until I am blue in the face.
  • Gravatar - Dan
    Dan 16:54, May 13, 2006
    Got the same problem as valtea!
  • Gravatar - Kyle
    Kyle 19:34, May 15, 2006
    Same problem as above!
  • Gravatar - Steve
    Steve 17:46, May 18, 2006
    Add it after the controls section. <br />
    <br />
    EG:<br />
    controls {<br />
    inet 127.0.0.1 allow { localhost; } keys { "rndckey"; };<br />
    };<br />
    <br />
    Add it here<br />
  • Gravatar - Nick
    Nick 08:35, June 27, 2006
    Thanks, this tutorial worked great!
  • Gravatar - Spock
    Spock 21:15, July 9, 2006
    Steve, I tried adding it after controls, but I receive this error:<br />
    <br />
    Stopping named: [ OK ]<br />
    Starting named: /etc/named.conf:17: missing ';' before '}'<br />
    /etc/named.conf:18: missing ';' before '}'<br />
    /etc/named.conf:19: missing ';' before '}'<br />
    <br />
    Jul 10 04:12:50.694 starting BIND 9.2.4 -g<br />
    Jul 10 04:12:50.717 using 1 CPU<br />
    Jul 10 04:12:50.722 loading configuration from '/etc/named.conf'<br />
    Jul 10 04:12:50.723 /etc/named.conf:1: open: /etc/rndc.key: permission denied<br />
    Jul 10 04:12:50.723 loading configuration: permission denied<br />
    Jul 10 04:12:50.723 exiting (due to fatal error)<br />
    Error in configuration file /etc/named.conf : [FAILED]<br />
    <br />
    ===================<br />
    Here are the first lines of my named.conf:<br />
    <br />
    include "/etc/rndc.key";<br />
    <br />
    controls {<br />
    inet 127.0.0.1 allow { localhost; } keys { "rndckey"; };<br />
    };<br />
    <br />
    acl "trusted" {<br />
    ip1;ip2;ip3;ip4;ip5;127.0.0.1;<br />
    };<br />
    <br />
    //<br />
    // named.conf for Red Hat caching-nameserver<br />
    //<br />
    <br />
    options {<br />
    directory "/var/named";<br />
    allow-recursion { trusted };<br />
    allow-notify { trusted };<br />
    allow-transfer { trusted };<br />
    dump-file "/var/named/data/cache_dump.db";<br />
    statistics-file "/var/named/data/named_stats.txt";<br />
    /*<br />
    * If there is a firewall between you and nameservers you want<br />
    * to talk to, you might need to uncomment the query-source<br />
    * directive below. Previous versions of BIND always asked<br />
    * questions using port 53, but BIND 8.1 uses an unprivileged<br />
    * port by default.<br />
    */<br />
    // query-source address * port 53;<br />
    version "surely ye jest?";<br />
    };<br />
    ===================<br />
    Suggestions?
  • Gravatar - Spock
    Spock 21:27, July 9, 2006
    Solved it! I just missed the ";" after the words trusted inside allow-recursion { trusted; }; etc.
  • Gravatar - Andrew
    Andrew 04:40, July 20, 2006
    How long does it takes dnsreport.com to update this info after you make changes?
  • Gravatar - Hussein
    Hussein 05:50, October 15, 2006
    Like Zac above noted.<br />
    All you need to do is add a like in the options sections that looks like this:<br />
    <br />
    recursion no;<br />
    <br />
    This should close your server.<br />
    <br />
    If you need to harden and secure Bind even more, you can have a look at this site:<br />
    <br />
    http://www.cymru.com/Documents/secure-bind-template.html<br />
    <br />
    You need to be carful, and back up your named.conf file before testing, but this is a complete secured Bind template.<br />
    <br />
    Cheers
  • Gravatar - Ricardo
    Ricardo 05:44, April 4, 2007
    I did all this things but the problem i have is that then my clients stop receiving emails and they are not able to send either i have added all the ips of the server plus 127.0.0.1...any ideas?
  • Gravatar - G
    G 03:59, June 1, 2007
    thanks worked a treat
  • Gravatar - ahmed
    ahmed 07:55, February 25, 2010
    close open dns

Add Your Thoughts

WebHostGear.com is a hosting directory, not a web host.

Copyright © 1998-2018 WebHostGear.com