Skip to main content
Unix & Linux

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

5
  • Yes, that is true for PHP script and I use that option. But I also had situation where atacker uploaded Perl script in upload bug in PHP script and than executed it (don't know how exactcly). And in situation like that I would like to prevent that user from using commands like ping, or curl etc. Commented Oct 6, 2015 at 11:30
  • Lol, ok so the question you posted is broader than I understood first. You are not only concerned about PHP command but also about shell commands. You can configure /bin/false as shell for www-data in /etc/passwd or use suPHP, so the programs run as other users so you have more possibilities to restrict their access. Commented Oct 6, 2015 at 13:11
  • @sebix, most probably if someone has reached the point of executing shell commands from the web he hasn't logged in, thus the shell the user has in /etc/passwd is not executed and has no effect at this stage, although it is a good security measure if that user never has to be logged in to the system. Commented Oct 7, 2015 at 8:04
  • Ok, I did what @sebix suggested and now I'm waiting for next atacker to test this on next attack. Commented Oct 7, 2015 at 8:24
  • @YoMismo Yes there's much more involved in hardening a server, this question is very broad. Commented Oct 7, 2015 at 13:24