Update of /cvsroot/phpshell/phpshell
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv27628

Modified Files:
        AUTHORS INSTALL README SECURITY config.php phpshell.php 
        pwhash.php style.css 
Log Message:
Replaced the static version number with one we can update dynamically
upon release.  Reflowed paragraphs to a shorter line width.


Index: AUTHORS
===================================================================
RCS file: /cvsroot/phpshell/phpshell/AUTHORS,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -d -r1.6 -r1.7
--- AUTHORS     13 Jan 2006 17:49:45 -0000      1.6
+++ AUTHORS     13 Jan 2006 17:59:28 -0000      1.7
@@ -1,4 +1,4 @@
-AUTHORS file for PHP Shell 2.1
+AUTHORS file for PHP Shell @VERSION@
 Copyright (C) 2000-2004 Martin Geisler <[EMAIL PROTECTED]>
 Licensed under the GNU GPL.  See the file COPYING for details.
 

Index: README
===================================================================
RCS file: /cvsroot/phpshell/phpshell/README,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -d -r1.7 -r1.8
--- README      13 Jan 2006 17:49:45 -0000      1.7
+++ README      13 Jan 2006 17:59:28 -0000      1.8
@@ -1,4 +1,4 @@
-README file for PHP Shell 2.1
+README file for PHP Shell @VERSION@
 Copyright (C) 2000-2005 Martin Geisler <[EMAIL PROTECTED]>
 Licensed under the GNU GPL.  See the file COPYING for details.
 

Index: config.php
===================================================================
RCS file: /cvsroot/phpshell/phpshell/config.php,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -d -r1.1 -r1.2
--- config.php  13 Jan 2006 17:49:45 -0000      1.1
+++ config.php  13 Jan 2006 17:59:28 -0000      1.2
@@ -1,54 +1,54 @@
-; <?php die('Forbidden'); ?>
-; Do not remove the above line, it prevents this file from being downloaded.
-;
-; config.php file for PHP Shell 2.1
-; Copyright (C) 2005 Martin Geisler <[EMAIL PROTECTED]>
-; Licensed under the GNU GPL.  See the file COPYING for details.
-
-; This ini-file has three parts:
-;
-; * [users] where you add usernames and passwords to give users access to PHP
-;   Shell.
-;
-; * [aliases] where you can configure shell aliases.
-;
-; * [settings] where general settings are placed.
-
-
-[users]
-
-; The default configuration has no users defined, you have to add your own
-; (choose good passwords!).  Add uses as simple 'username = "password"' lines.
-; Please quote your password using double-quotes as shown.  The semi-colon ':'
-; is a reserved character, so do *not* use that in your passwords.
-;
-; For improved security it is *strongly suggested* that you the pwhash.php
-; script to generate a hashed password and store that instead of the normal
-; clear text password.  Keeping your passwords in hashed form ensures that
-; they cannot be found, even if this file is disclosed.  The passwords are
-; still visible in clear text during the login, though.  Please follow the
-; instructions given in pwhash.php.
-
-
-
-[aliases]
-
-; Alias expansion.  Change the two examples as needed and add your own
-; favorites --- feel free to suggest more defaults!  The command line you
-; enter will only be expanded on the very first token and only once, so having
-; 'ls' expand into 'ls -CvhF' does not cause an infinite recursion.
-
-ls = "ls -CvhF"
-ll = "ls -lvhF"
-
-
-
-[settings]
-
-; General settings for PHP Shell.
-
-; Home directory.  PHP Shell will change to this directory upon startup and
-; whenever a bare 'cd' command is given.  This can be an absolute path or a
-; path relative to the PHP Shell installation directory.
-
-home-directory = "."
+; <?php die('Forbidden'); ?>
+; Do not remove the above line, it prevents this file from being downloaded.
+;
+; config.php file for PHP Shell @VERSION@
+; Copyright (C) 2005, 2006  Martin Geisler <[EMAIL PROTECTED]>
+; Licensed under the GNU GPL.  See the file COPYING for details.
+
+; This ini-file has three parts:
+;
+; * [users] where you add usernames and passwords to give users access to PHP
+;   Shell.
+;
+; * [aliases] where you can configure shell aliases.
+;
+; * [settings] where general settings are placed.
+
+
+[users]
+
+; The default configuration has no users defined, you have to add your own
+; (choose good passwords!).  Add uses as simple 'username = "password"' lines.
+; Please quote your password using double-quotes as shown.  The semi-colon ':'
+; is a reserved character, so do *not* use that in your passwords.
+;
+; For improved security it is *strongly suggested* that you the pwhash.php
+; script to generate a hashed password and store that instead of the normal
+; clear text password.  Keeping your passwords in hashed form ensures that
+; they cannot be found, even if this file is disclosed.  The passwords are
+; still visible in clear text during the login, though.  Please follow the
+; instructions given in pwhash.php.
+
+
+
+[aliases]
+
+; Alias expansion.  Change the two examples as needed and add your own
+; favorites --- feel free to suggest more defaults!  The command line you
+; enter will only be expanded on the very first token and only once, so having
+; 'ls' expand into 'ls -CvhF' does not cause an infinite recursion.
+
+ls = "ls -CvhF"
+ll = "ls -lvhF"
+
+
+
+[settings]
+
+; General settings for PHP Shell.
+
+; Home directory.  PHP Shell will change to this directory upon startup and
+; whenever a bare 'cd' command is given.  This can be an absolute path or a
+; path relative to the PHP Shell installation directory.
+
+home-directory = "."

Index: style.css
===================================================================
RCS file: /cvsroot/phpshell/phpshell/style.css,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -d -r1.1 -r1.2
--- style.css   13 Jan 2006 17:49:45 -0000      1.1
+++ style.css   13 Jan 2006 17:59:28 -0000      1.2
@@ -1,4 +1,4 @@
-/* style.css file for PHP Shell 2.1
+/* style.css file for PHP Shell @VERSION@
  * Copyright (C) 2003-2005 Martin Geisler <[EMAIL PROTECTED]>
  * Licensed under the GNU GPL.  See the file COPYING for details.
  */

Index: INSTALL
===================================================================
RCS file: /cvsroot/phpshell/phpshell/INSTALL,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -d -r1.6 -r1.7
--- INSTALL     13 Jan 2006 17:49:45 -0000      1.6
+++ INSTALL     13 Jan 2006 17:59:28 -0000      1.7
@@ -1,4 +1,4 @@
-INSTALL file for PHP Shell 2.1
+INSTALL file for PHP Shell @VERSION@
 Copyright (C) 2000-2005 Martin Geisler <[EMAIL PROTECTED]>
 Licensed under the GNU GPL.  See the file COPYING for details.
 
@@ -17,7 +17,7 @@
 
 Installation is easy: first unpack the tarball or zipfile downloaded from the
 above website into your webserver.  This will create a subdirectory called
-phpweather-2.1 for PHP Shell version 2.1.
[EMAIL PROTECTED]@ for PHP Shell version @[EMAIL PROTECTED]
 
 Try loading the file ``phpshell.php`` in your browser and check that you are
 served a page that asks you to authenticate yourself with a username and a

Index: pwhash.php
===================================================================
RCS file: /cvsroot/phpshell/phpshell/pwhash.php,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -d -r1.1 -r1.2
--- pwhash.php  13 Jan 2006 17:49:45 -0000      1.1
+++ pwhash.php  13 Jan 2006 17:59:28 -0000      1.2
@@ -1,6 +1,6 @@
 <?php
 /*
- * pwhash.php file for PHP Shell 2.1
+ * pwhash.php file for PHP Shell @VERSION@
  * Copyright (C) 2005 Martin Geisler <[EMAIL PROTECTED]>
  * Licensed under the GNU GPL.  See the file COPYING for details.
  */
@@ -23,13 +23,13 @@
    "http://www.w3.org/TR/html4/strict.dtd";>
 <html>
 <head>
-  <title>Password Hasher for PHP Shell 2.1</title>
+  <title>Password Hasher for PHP Shell @VERSION@</title>
   <link rel="stylesheet" href="style.css" type="text/css">
 </head>
 
 <body>
 
-<h1>Password Hasher for PHP Shell 2.1</h1>
+<h1>Password Hasher for PHP Shell @VERSION@</h1>
 
 <form action="<?php $_SERVER['PHP_SELF']; ?>" method="POST">
 

Index: phpshell.php
===================================================================
RCS file: /cvsroot/phpshell/phpshell/phpshell.php,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -d -r1.7 -r1.8
--- phpshell.php        13 Jan 2006 17:49:45 -0000      1.7
+++ phpshell.php        13 Jan 2006 17:59:28 -0000      1.8
@@ -3,14 +3,14 @@
 /*
 
   **************************************************************
-  *                     PHP Shell 2.1                          *
+  *                     PHP Shell @VERSION@                          *
   **************************************************************
 
   PHP Shell is an interactive PHP script that will execute any command
   entered.  See the files README, INSTALL, and SECURITY or
   http://mgeisler.net/php-shell/ for further information.
 
-  Copyright (C) 2000-2005 Martin Geisler <[EMAIL PROTECTED]>
+  Copyright (C) 2000-2006  Martin Geisler <[EMAIL PROTECTED]>
 
   This program is free software; you can redistribute it and/or
   modify it under the terms of the GNU General Public License
@@ -46,7 +46,7 @@
    "http://www.w3.org/TR/html4/strict.dtd";>
 <html>
 <head>
-  <title>PHP Shell 2.1</title>
+  <title>PHP Shell @VERSION@</title>
   <link rel="stylesheet" href="style.css" type="text/css">
 </head>
 <body>
@@ -270,7 +270,7 @@
    "http://www.w3.org/TR/html4/strict.dtd";>
 <html>
 <head>
-  <title>PHP Shell 2.1</title>
+  <title>PHP Shell @VERSION@</title>
   <link rel="stylesheet" href="style.css" type="text/css">
 
   <script type="text/javascript">
@@ -315,7 +315,7 @@
 
 <body onload="init()">
 
-<h1>PHP Shell 2.1</h1>
+<h1>PHP Shell @VERSION@</h1>
 
 <form name="shell" action="<?php echo $_SERVER['PHP_SELF'] ?>" method="post">
 

Index: SECURITY
===================================================================
RCS file: /cvsroot/phpshell/phpshell/SECURITY,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -d -r1.1 -r1.2
--- SECURITY    13 Jan 2006 17:49:45 -0000      1.1
+++ SECURITY    13 Jan 2006 17:59:28 -0000      1.2
@@ -1,89 +1,93 @@
-SECURITY file for PHP Shell 2.1
-Copyright (C) 2005 Martin Geisler <[EMAIL PROTECTED]>
+SECURITY file for PHP Shell @VERSION@
+Copyright (C) 2005, 2006  Martin Geisler <[EMAIL PROTECTED]>
 Licensed under the GNU GPL.  See the file COPYING for details.
 
 
 PHP Security
 ============
 
-Installing PHP on your server is an inheriently dangerous thing to do,
-somewhat similar to the danger one faces when one buys a car: it might kill
-you if you have an accident.  On the other hand a car makes so many things so
-much more convenient, so most people are willing to accept the risk of
-accidents.
+Installing PHP on your server is an inherently dangerous thing to do,
+somewhat similar to the danger one faces when one buys a car: it might
+kill you if you have an accident.  On the other hand a car makes so
+many things so much more convenient, so most people are willing to
+accept the risk of accidents.
 
-Likewise, PHP is a powerful tool which will let you build your webpages easier
-and faster than without.  But it is a *very* powerful tool --- PHP is a full
-programming language which can be used for general purpose programming and not
-just to format HTML for display in a browser.
+Likewise, PHP is a powerful tool which will let you build your
+webpages easier and faster than without.  But it is a *very* powerful
+tool --- PHP is a full programming language which can be used for
+general purpose programming and not just to format HTML for display in
+a browser.
 
-So PHP has support for reading and writing files on the filesystem.  But PHP
-also has support for *deleting* files.  PHP even has support for executing
-other programs.  In other words, PHP has lots of support for interacting with
-the rest of the computer it runs on.  This interaction is potentially much
-more powerful than you want it to, and this can be a problem if this power
-ends up in the wrong hands.
+So PHP has support for reading and writing files on the filesystem.
+But PHP also has support for *deleting* files.  PHP even has support
+for executing other programs.  In other words, PHP has lots of support
+for interacting with the rest of the computer it runs on.  This
+interaction is potentially much more powerful than you want it to, and
+this can be a problem if this power ends up in the wrong hands.
 
 
 What about Safe Mode?
 ---------------------
 
-As they note in the PHP manual, Safe Mode is an inherently wrong way to secure
-PHP, but is nevertheless used in many installations.  Turning Safe Mode on in
-PHP basically tries to restrict the language and its functions to make it
-"safe".
+As they note in the PHP manual, Safe Mode is an inherently wrong way
+to secure PHP, but is nevertheless used in many installations.
+Turning Safe Mode on in PHP basically tries to restrict the language
+and its functions to make it "safe".
 
-This involves a strict check on file ownership so that PHP wont operate on
-files and directories which are not owned by the owner of the current script.
-Other restrictions in Safe Mode include limits on which files can be executed
-and includes (thus making a primitive form of chroot or jail around the PHP
-script).
+This involves a strict check on file ownership so that PHP wont
+operate on files and directories which are not owned by the owner of
+the current script.  Other restrictions in Safe Mode include limits on
+which files can be executed and includes (thus making a primitive form
+of chroot or jail around the PHP script).
 
 PHP Shell is made mostly useless with Safe Mode since it restricts the two
 commands that PHP Shell uses: ``chdir()`` and ``proc_open()``:
 
-* With Safe Mode you cannot change to a directory unless you are the owner of
-  that directory.  This means that you cannot change to, say, ``/etc`` since
-  ``root`` own that directory.
+* With Safe Mode you cannot change to a directory unless you are the
+  owner of that directory.  This means that you cannot change to, say,
+  ``/etc`` since ``root`` own that directory.
 
   You'll see this when 'cd /etc' results in this error from PHP Shell:
 
-    chdir(): SAFE MODE Restriction in effect.  The script whose uid is 500 is
-    not allowed to access /etc owned by uid 0
-    cd: could not change to: /etc
+    chdir(): SAFE MODE Restriction in effect.  The script whose uid is
+    500 is not allowed to access /etc owned by uid 0 cd: could not
+    change to: /etc
 
-* When Safe Mode is active, PHP forces the argument to ``proc_open()`` to be
-  escaped, which means that you cannot use normal shell wildcards, pipes or
-  any such stuff.
+* When Safe Mode is active, PHP forces the argument to ``proc_open()``
+  to be escaped, which means that you cannot use normal shell
+  wildcards, pipes or any such stuff.
 
-  So if you enter 'ls *.txt' in a directory where you know for certain that
-  there is a text file ending in '.txt', you will get the following error:
+  So if you enter 'ls *.txt' in a directory where you know for certain
+  that there is a text file ending in '.txt', you will get the
+  following error:
 
     /bin/ls: *.txt: No such file or directory
 
-  This is because PHP has silently changed the command into 'ls \*.txt' to
-  disable the wildcard.
+  This is because PHP has silently changed the command into 'ls
+  \*.txt' in order to disable the wildcard.  There is nothing PHP
+  Shell can do about this.
 
-* You cannot execute programs unless they are placed in a directory listed in
-  ``safe_mode_exec_dir``.  Say you want to execute the program ``tr`` (which
-  translates between sets of characters) and you get this strange messages
-  back:
+* You cannot execute programs unless they are placed in a directory
+  listed in ``safe_mode_exec_dir``.  Say you want to execute the
+  program ``tr`` (which translates between sets of characters) and you
+  get this strange messages back:
 
     sh: line 1: /bin/tr: No such file or directory
 
-  Then you have a problem with the ``safe_mode_exec_dir`` setting.  In this
-  case ``safe_mode_exec_dir`` is set to just ``/bin`` and so PHP has forced
-  the shell to execute ``/bin/tr`` and since ``tr`` is installed in
-  ``/usr/bin`` it could not be found.
+  Then you have a problem with the ``safe_mode_exec_dir`` setting.  In
+  this case ``safe_mode_exec_dir`` is set to just ``/bin`` and so PHP
+  has forced the shell to execute ``/bin/tr`` and since ``tr`` is
+  installed in ``/usr/bin`` it could not be found.
 
-  If you have write access to a directory listed in ``safe_mode_exec_dir``,
-  then try copying the wanted program there first.  Executing it should now
-  work.
+  If you have write access to a directory listed in
+  ``safe_mode_exec_dir``, then try copying the wanted program there
+  first.  Executing it should now work.
 
 
-Even without enabling Safe Mode some functions might have been disabled via
-the ``disabled_functions`` setting.  If the ``proc_open()`` function used by
-PHP Shell has been disabled, then you will see an error like this:
+Even without enabling Safe Mode some functions might have been
+disabled via the ``disabled_functions`` setting.  If the
+``proc_open()`` function used by PHP Shell has been disabled, then you
+will see an error like this:
 
     Fatal Error!
 
@@ -96,40 +100,81 @@
 PHP Shell Security
 ==================
 
-As noted above, PHP is a powerful tool --- how does PHP Shell fit into this?
-PHP Shell is actually quite simple and does one thing: it uses the standard
-PHP function ``proc_open()`` to execute programs.
+As noted above, PHP is a powerful tool --- how does PHP Shell fit into
+this?  PHP Shell is actually quite simple and does one thing: it uses
+the standard PHP function ``proc_open()`` to execute programs.
 
-Executing other programs is probably the most powerful thing you can do in
-PHP, and so PHP Shell gives you a convenient interface to this the most
-powerful feature of PHP.  Nothing more.
+Executing other programs is probably the most powerful thing you can
+do in PHP, and so PHP Shell gives you a convenient interface to this
+the most powerful feature of PHP.  Nothing more.
 
 
 Is PHP Shell Dangerous?
 -----------------------
 
-Short answer: *yes*!  PHP Shell has been used in the past by people with
-not-so-good intentions to destroy valuable content on servers.
+Short answer: *yes*!  PHP Shell has been used in the past by people
+with not-so-good intentions to destroy valuable content on servers.
 
-The longer answer is that installing PHP Shell is like building a new door in
-your house --- if you leave it unlocked, then people can (and probably will!)
-walk into it and steal your posessions.  So you want to lock it, and make sure
-you use a good lock.
+The longer answer is that installing PHP Shell is like building a new
+door in your house --- if you leave it unlocked, then people can (and
+probably will!)  walk into it and steal your possessions.  So you want
+to lock it, and make sure you use a good lock.
 
-With PHP Shell that is equivalent of using a secure password.  A secure
-password is one which is hard to guess (make it long, make it random, and put
-both numbers, special characters and normal letters in it).
+With PHP Shell that is equivalent of using a secure password.  A
+secure password is one which is hard to guess (make it long, make it
+random, and put both numbers, special characters and normal letters in
+it).
 
-  Remember that guessing the password is all that stands between the crackers
-  and your files!
+  Remember that guessing the password is all that stands between the
+  crackers and your files!
 
-If you use a good password, then PHP Shell does not make your system any more
-unsecure than it already was.  Security is always a matter of finding the
-weakest link in the chain: if you use FTP with a simple password for updating
-your site, then it would be much easier for the crackers to attack that
-instead of trying to guess your super-hard PHP Shell password.  So make sure
-that you tighten security on all fronts you know of.
+If you use a good password, then PHP Shell does not make your system
+any more insecure than it already was.  Security is always a matter of
+finding the weakest link in the chain: if you use FTP with a simple
+password for updating your site, then it would be much easier for the
+crackers to attack that instead of trying to guess your super-hard PHP
+Shell password.  So make sure that you tighten security on all fronts
+you know of.
 
 
+Other Threats
+-------------
+
+Aside the obvious threat of someone guessing your password as
+discussed above, there is another threat when using PHP Shell: all
+communication is done in clear text!
+
+This means that anybody who is able to intercept the traffic between
+your browser and the server will receive the password, all the
+commands you type, and all the output of those commands. Using hashed
+passwords makes no difference here, the password is still sent in the
+clear and is only hashed after having arrived at the server.
+
+With a normal network setup your traffic will go through a number of
+intermediate nodes before reaching its goal. For example, when my
+browser sends the password, it has to go through no less than 15
+computers before reaching the server. Any of those computers could
+potentially save the traffic for later analysis and so save the
+password.
+
+So counter this threat you can establish an encrypted connection
+between the browser and the server. This is called an SSL (Secure
+Socket Layer) connection and one runs HTTPS (Secure HTTP) over it.
+
+Unfortunately you cannot just create such a connection without first
+installing a SSL certificate on the server, something which the server
+administrator will have to do for you. Furthermore, a real SSL
+certificate costs money, and if you are willing to pay for such a
+certificate, then you are probably also willing to pay for a quality
+host which offers SSH access.
+
+So: SSL is the answer to the threat of eavesdropping, but if you have
+SSL available, then you probably also have SSH available, and thus no
+need for PHP Shell --- a funny chicken-and-egg problem :-)
+
+
+Feedback
+========
+
 If you have suggestions for improvements to this little guide in system
 security, then please do not hesitate to contact <[EMAIL PROTECTED]>.



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
phpshell-commits mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/phpshell-commits

Reply via email to