Re: ping22: can not kill this process
Em Friday 04 January 2008 04:46:48 Rick Moen escreveu: Looking at the typical php.ini is faintly terrifying, starting with the almost invariably ignored warning comments at the top, saying these settings are for development environments only, and should never be exposed to public networks. From the mentioned section in php.ini: ; By default, PHP installs itself with a configuration suitable for ; development purposes, and *NOT* for production purposes. Anybody has a clue as to why was this default choosen, and not the safest one? regards FF
Re: ping22: can not kill this process
On Fri Jan 04, 2008 at 06:04:50 -0200, Felipe Figueiredo wrote: Anybody has a clue as to why was this default choosen, and not the safest one? Too many broken PHP applications? Anyway please see /usr/share/doc/php4-common/examples/ for different examples. (Or /usr/share/doc/php5-common/examples). Steve -- http://www.steve.org.uk/ pgpiQG2VvWmON.pgp Description: PGP signature
Install process certification
Hi I'd like to know whether it's possible to check the signature of a Debian (Etch) install CD, at the earliest stage of the install process. Indeed, right after the base-installer unpacks the base system files, apt loads the contents of the CD and checks the Release.gpg signature against the Release file. Two problems, however: - apt will complain if the signature is wrong, but won't if the Release.gpg file is not even present on the CD; - this procedure excludes the udebs loaded by debian-installer So, is there a way to secure the whole install process (I mean, besides manual checking)? I noticed that gpgv is among the default udebs, what is it used for? Thanks, -- Keyser _ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail http://mail.yahoo.fr
Re: ping22: can not kill this process
On Thu, Jan 03, 2008 at 08:55:11PM -0500, Luis Mondesi wrote: And besides, noexec can't even stop executables anyway. That's the stupidest of flags for mount: $ /lib/ld-linux.so.2 /usr/bin/printf %s\n foo foo I think some of the newer dynamic loaders do check noexec and refuse to circumvent it. -- Marcin Owsiany [EMAIL PROTECTED] http://marcin.owsiany.pl/ GnuPG: 1024D/60F41216 FE67 DA2D 0ACA FC5E 3F75 D6F6 3A0D 8AA0 60F4 1216 -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: ping22: can not kill this process
Quoting Javier Fernandez-Sanguino ([EMAIL PROTECTED]): Even better: /usr/share/doc/php5-common/examples/php.ini-paranoid (it includes some more functions in that definition) Excellent. Amended to: disable_functions = dl, phpinfo, system, mail, include, shell_exec, exec, escapeshellarg, escapeshellcmd, passthru, proc_close, proc_open, proc_get_status, proc_nice, proc_open, proc_terminate, popen, pclose, chown, disk_free_space, disk_total_space, diskfreespace, fileinode, max_execution_time, set_time_limit,highlight_file, show_source I'll be cross-checking those on a PHP4 installation to see if they're all valid, which they might not be. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: ping22: can not kill this process
2008/1/4, Rick Moen [EMAIL PROTECTED]: Quoting Luis Mondesi ([EMAIL PROTECTED]): It's time to tell PHP (via php.ini) not to allow any of those functions that allow executing stuff from the system (system, passthru, whatever). Amen to that. Good starting point: disable_functions = system, exec, passthru, popen, escapeshellcmd, shell_exec Even better: /usr/share/doc/php5-common/examples/php.ini-paranoid (it includes some more functions in that definition) IIRC it includes those and some more. You might want to diff your php.ini copy to that one to see the different things you could do to improve your PHP installation. Regards Javier -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: Install process certification
On Fri, Jan 04, 2008 at 11:15:35AM +, Keyser S?ze wrote: Hi I'd like to know whether it's possible to check the signature of a Debian (Etch) install CD, at the earliest stage of the install process. Indeed, right after the base-installer unpacks the base system files, apt loads the contents of the CD and checks the Release.gpg signature against the Release file. Two problems, however: - apt will complain if the signature is wrong, but won't if the Release.gpg file is not even present on the CD; - this procedure excludes the udebs loaded by debian-installer So, is there a way to secure the whole install process (I mean, besides manual checking)? I noticed that gpgv is among the default udebs, what is it used for? Perhaps I don't understand manual checking. Would you be satisfied by checking a signature of a checksum of the CD against a public key that you trust ? http://www.debian.org/CD/faq/#verify Regards, Paddy -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: ping22: can not kill this process
On Fri, 04 Jan 2008 08:23:45 +0100 Bernd Eckenfels [EMAIL PROTECTED] wrote: what kind applications are using /dev/shm? I googled around,seem not find much information. right now I mount i as rw,noexec,nosuid. It is for example used to map shared memory. ... No, it is a tmpfs directory for temporary files. It has nothing to do with shared memory. -- Hubert Chathi [EMAIL PROTECTED] -- Jabber: [EMAIL PROTECTED] PGP/GnuPG key: 1024D/124B61FA http://www.uhoreg.ca/ Fingerprint: 96C5 012F 5F74 A5F7 1FF7 5291 AF29 C719 124B 61FA -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: ping22: can not kill this process
Quoting Raphael Geissert ([EMAIL PROTECTED]): include()? I don't want to imagine how many scripts will break. Good catch. (It was very late in my time zone. I need to review that list.) -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: ping22: can not kill this process
Rick Moen wrote: disable_functions = dl, phpinfo, system, mail, include, shell_exec, exec, include()? I don't want to imagine how many scripts will break. Cheers, -- Atomo64 - Raphael Please avoid sending me Word, PowerPoint or Excel attachments. See http://www.gnu.org/philosophy/no-word-attachments.html -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: ping22: can not kill this process
In article [EMAIL PROTECTED] you wrote: It is for example used to map shared memory. ... No, it is a tmpfs directory for temporary files. It has nothing to do with shared memory. why do you think it is named shm? it is used for shm_open and shm_unlink. (where glibc used temporary files to mmap them) On some systems (like mine) tmp is a symlink to it, or you use a second instance of tmpfs. However is still is used for share memory (only). Gruss Bernd -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: ping22: can not kill this process
On Fri, 04 Jan 2008 22:30:18 +0100 Bernd Eckenfels [EMAIL PROTECTED] wrote: why do you think it is named shm? it is used for shm_open and shm_unlink. (where glibc used temporary files to mmap them) Ah, I see. I have never come across a program (yet) that uses it for shared memory. Perhaps I'm just running the wrong programs. On some systems (like mine) tmp is a symlink to it, or you use a second instance of tmpfs. However is still is used for share memory (only). Actually, some things use /dev/shm for non-shared-memory purposes. Like the resolvconf package. -- Hubert Chathi [EMAIL PROTECTED] -- Jabber: [EMAIL PROTECTED] PGP/GnuPG key: 1024D/124B61FA http://www.uhoreg.ca/ Fingerprint: 96C5 012F 5F74 A5F7 1FF7 5291 AF29 C719 124B 61FA -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: ping22: can not kill this process
In article [EMAIL PROTECTED] you wrote: Ah, I see. I have never come across a program (yet) that uses it for shared memory. Perhaps I'm just running the wrong programs. The program itself is not using it, its glibc2.2 which does use that (for POSIX shm, I think not for SYSV. so its quite seldom used). I need to double check, but one possible user could be Java with -XX:+UseLargePages if it does not use hugetlbfs. Actually, some things use /dev/shm for non-shared-memory purposes. Like the resolvconf package. I would consider that a bug, but sure possible. Gruss Bernd -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
