Mod Security is good for you!

Since I'm back, I've got a few days worth of log files to dig through. A couple of years ago an old legacy PHP script Pleth was running wasn't very secure, but was critical to the operations of a particular customer. It got hacked (well, they used it to upload a C99Shell) a couple of times before the vendor released an update. Scouring the internet for a solution, I learned of Mod Mod Security, an application firewall of sorts. It runs as a module in your Apache configuration and uses a set of user-configurable rules files to detect and prevent a number of attacks against a website. The rules list has a huge community backing, and people have written rules for about every vulnerability out there. Open Source is good no? Anyway, as I was digging through those files today it kinda shocked me to see just how much stuff mod_sec blocked. The internet is a dangerous place.....

Among the same lines, you can further protect your server by making a few small php.ini changes as well. Look for the line in yours that says

disable_functions = "........

and make sure you add

shell_exec,escapeshellarg

to the list there. This will prevent PHP from operating as a shell, which you really don't need anyway (well, you shouldn't in my opinion). There's about a million different things you can actually disable, but some of them are needed.

Another PHP trick is open_basedir, which is a php configuration directive that sorta "jails" the scripts to whatever directories are listed in the open_basedir directive for that particular domain.

From the manual page:

When a script tries to open a file with, for example, fopen() or gzopen(), the location of the
file is checked. When the file is outside the specified directory-tree, PHP will refuse to open
it. All symbolic links are resolved, so it's not possible to avoid this restriction with a
symlink.

It's not the most friendly option on the planet, but it does work and takes a bit of careful configuration to get it working right. For a site that might be considered risky, it's worth the effort.

Just don't be fooled into thinking that these fixes are the end-all-do-all. Security is a never-ending process. PHP is just one aspect of it.