3 ms·
> file_get_contents on most hosts does not allow external URL's This is still not really a gain in security, but ... > The other thing I have in my firewall i
by vog 17y ago
> file_get_contents on most hosts does not allow external URL's
This is still not really a gain in security, but ...
> The other thing I have in my firewall is all outgoing access is blocked for the user that PHP runs under
... this is! And since you do that, there is no need for strange measures like providing Curl but not Wget.
Wget, Curl and allow_url_fopen are just tools to access the network API. So you need to block that API, rather than blocking some tools which merely use that API.
Although I fully agree that it improves security if you remove all services that aren't needed, I don't think the same holds for tools. (except if they are SUID binaries, but such a program is in fact more a service than a tool)
- X-Istence 17y agoHaving outbound access from the PHP user blocked is not always possible due to client needs to interact with remote services or API's (Flickr, Google, Twitter). Generally those run under a different user (yay FastCGI) but still can leave holes exposed that may not be easy to fix. If having no wget installed removes one or two possibilities for an exploit it is a win in my book.
- DougBTX 17y agoGood points all round, X-Istence is suggesting defense in depth, and you (vog) suggest making sure the outer perimeter is secure. Both good ideas - even if you fill the hall with barbed wire, you should make sure to lock the front door. Beyond that, it's a trade off.