3 ms·

> most attacks that attack PHP tend to use wget to download further files Nowadays, neither Wget nor Curl is required for downloading in PHP, because functions

by vog 17y ago

> most attacks that attack PHP tend to use wget to download further files Nowadays, neither Wget nor Curl is required for downloading in PHP, because functions like file_get_contents() are able to handle URL arguments! So a missing Wget protects only against script kiddies who don't know PHP very well and copied over some outdated code snippets. Also, not installing Wget "protects" you just from those kind of primitive attacks to which your system shouldn't be vulnerable in the first place. Security is achieved by sealing entry doors, not by removing tools.

X-Istence 17y ago
file_get_contents on most hosts does not allow external URL's, including the one where I am an administrator. http://www.php.net/manual/en/filesystem.configuration.php#ini.allow-url-fopen http://www.php.net/manual/en/filesystem.configuration.php#in... Also, installing wget is just one more way to defend a server that is hosting multiple sites with multiple scripts all of which can not be trusted all the time. I don't know if tomorrow a new bug is found in phpBB that allows a remote exploit that runs as the user php runs under, if not having wget stops one such exploit it is a win in my book. The other thing I have in my firewall is all outgoing access is blocked for the user that PHP runs under so that in the event something does happen and something is executed under that user it won't be able to make an outbound connection or get inbound connections. Yes, security is achieved by sealing entry doors, but removing an entry door in the first place may be even better, wget being an entry door, unfortunately the front door is a huge gaping mess you could drive a truck through, but that is unfortunately required for the business I am in, administrating a server with multiple websites running various PHP scripts.
- vog 17y ago
  > file_get_contents on most hosts does not allow external URL's This is still not really a gain in security, but ... > The other thing I have in my firewall is all outgoing access is blocked for the user that PHP runs under ... this is! And since you do that, there is no need for strange measures like providing Curl but not Wget. Wget, Curl and allow_url_fopen are just tools to access the network API. So you need to block that API, rather than blocking some tools which merely use that API. Although I fully agree that it improves security if you remove all services that aren't needed, I don't think the same holds for tools. (except if they are SUID binaries, but such a program is in fact more a service than a tool)
  - X-Istence 17y ago
    Having outbound access from the PHP user blocked is not always possible due to client needs to interact with remote services or API's (Flickr, Google, Twitter). Generally those run under a different user (yay FastCGI) but still can leave holes exposed that may not be easy to fix. If having no wget installed removes one or two possibilities for an exploit it is a win in my book.
  - DougBTX 17y ago
    Good points all round, X-Istence is suggesting defense in depth, and you (vog) suggest making sure the outer perimeter is secure. Both good ideas - even if you fill the hall with barbed wire, you should make sure to lock the front door. Beyond that, it's a trade off.

by vog 17y ago

X-Istence 17y ago

file_get_contents on most hosts does not allow external URL's, including the one where I am an administrator. http://www.php.net/manual/en/filesystem.configuration.php#ini.allow-url-fopen http://www.php.net/manual/en/filesystem.configuration.php#in... Also, installing wget is just one more way to defend a server that is hosting multiple sites with multiple scripts all of which can not be trusted all the time. I don't know if tomorrow a new bug is found in phpBB that allows a remote exploit that runs as the user php runs under, if not having wget stops one such exploit it is a win in my book. The other thing I have in my firewall is all outgoing access is blocked for the user that PHP runs under so that in the event something does happen and something is executed under that user it won't be able to make an outbound connection or get inbound connections. Yes, security is achieved by sealing entry doors, but removing an entry door in the first place may be even better, wget being an entry door, unfortunately the front door is a huge gaping mess you could drive a truck through, but that is unfortunately required for the business I am in, administrating a server with multiple websites running various PHP scripts.

vog 17y ago
> file_get_contents on most hosts does not allow external URL's This is still not really a gain in security, but ... > The other thing I have in my firewall is all outgoing access is blocked for the user that PHP runs under ... this is! And since you do that, there is no need for strange measures like providing Curl but not Wget. Wget, Curl and allow_url_fopen are just tools to access the network API. So you need to block that API, rather than blocking some tools which merely use that API. Although I fully agree that it improves security if you remove all services that aren't needed, I don't think the same holds for tools. (except if they are SUID binaries, but such a program is in fact more a service than a tool)
- X-Istence 17y ago
  Having outbound access from the PHP user blocked is not always possible due to client needs to interact with remote services or API's (Flickr, Google, Twitter). Generally those run under a different user (yay FastCGI) but still can leave holes exposed that may not be easy to fix. If having no wget installed removes one or two possibilities for an exploit it is a win in my book.
- DougBTX 17y ago
  Good points all round, X-Istence is suggesting defense in depth, and you (vog) suggest making sure the outer perimeter is secure. Both good ideas - even if you fill the hall with barbed wire, you should make sure to lock the front door. Beyond that, it's a trade off.