0

I operate a small shared hosting area. While I notice that people are unable/struggle to exploit with PHP I have found a small minority of people using Perl in order to obtain server information.

So, to put it simply here is the question I would like to ask -

Is there a way to prevent Perl scripts from accessing certain system critical files such as named.conf /etc/passwd & others? Naturally suhosin/ suphp or php.ini does not protect against this when in a perl scenario.

John Gardeniers
  • 27,458
  • 12
  • 55
  • 109
Chris
  • 1,289
  • 2
  • 18
  • 34

1 Answers1

5

chroot the users and/or Apache ( example 1 example 2, example 3 )

RedGrittyBrick
  • 3,832
  • 1
  • 17
  • 23
  • I suggest chrooting both, as well as bind and any other public facing services. – John Gardeniers May 09 '11 at 02:16
  • Thanks for your response and I cannot agree more. Just one issue, I am running a cPanel/ LiteSpeed setup. While I am sure LiteSpeed will run within the chroot fine, cPanel not so much! – Chris May 10 '11 at 06:59