Menu
▾
▴
phpshell AUTHORS,1.6,1.7 INSTALL,1.6,1.7 README,1.7,1.8 SECURITY,1.1,1.2 config.php,1.1,1.2 phpshell.php,1.7,1.8 pwhash.php,1.1,1.2 style.css,1.1,1.2
|
From: Martin G. <mge...@us...> - 2006-01-13 17:59:41
|
Update of /cvsroot/phpshell/phpshell In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv27628 Modified Files: AUTHORS INSTALL README SECURITY config.php phpshell.php pwhash.php style.css Log Message: Replaced the static version number with one we can update dynamically upon release. Reflowed paragraphs to a shorter line width. Index: AUTHORS =================================================================== RCS file: /cvsroot/phpshell/phpshell/AUTHORS,v retrieving revision 1.6 retrieving revision 1.7 diff -u -d -r1.6 -r1.7 --- AUTHORS 13 Jan 2006 17:49:45 -0000 1.6 +++ AUTHORS 13 Jan 2006 17:59:28 -0000 1.7 @@ -1,4 +1,4 @@ -AUTHORS file for PHP Shell 2.1 +AUTHORS file for PHP Shell @VERSION@ Copyright (C) 2000-2004 Martin Geisler <mge...@mg...> Licensed under the GNU GPL. See the file COPYING for details. Index: README =================================================================== RCS file: /cvsroot/phpshell/phpshell/README,v retrieving revision 1.7 retrieving revision 1.8 diff -u -d -r1.7 -r1.8 --- README 13 Jan 2006 17:49:45 -0000 1.7 +++ README 13 Jan 2006 17:59:28 -0000 1.8 @@ -1,4 +1,4 @@ -README file for PHP Shell 2.1 +README file for PHP Shell @VERSION@ Copyright (C) 2000-2005 Martin Geisler <mge...@mg...> Licensed under the GNU GPL. See the file COPYING for details. Index: config.php =================================================================== RCS file: /cvsroot/phpshell/phpshell/config.php,v retrieving revision 1.1 retrieving revision 1.2 diff -u -d -r1.1 -r1.2 --- config.php 13 Jan 2006 17:49:45 -0000 1.1 +++ config.php 13 Jan 2006 17:59:28 -0000 1.2 @@ -1,54 +1,54 @@ -; <?php die('Forbidden'); ?> -; Do not remove the above line, it prevents this file from being downloaded. -; -; config.php file for PHP Shell 2.1 -; Copyright (C) 2005 Martin Geisler <mge...@mg...> -; Licensed under the GNU GPL. See the file COPYING for details. - -; This ini-file has three parts: -; -; * [users] where you add usernames and passwords to give users access to PHP -; Shell. -; -; * [aliases] where you can configure shell aliases. -; -; * [settings] where general settings are placed. - - -[users] - -; The default configuration has no users defined, you have to add your own -; (choose good passwords!). Add uses as simple 'username = "password"' lines. -; Please quote your password using double-quotes as shown. The semi-colon ':' -; is a reserved character, so do *not* use that in your passwords. -; -; For improved security it is *strongly suggested* that you the pwhash.php -; script to generate a hashed password and store that instead of the normal -; clear text password. Keeping your passwords in hashed form ensures that -; they cannot be found, even if this file is disclosed. The passwords are -; still visible in clear text during the login, though. Please follow the -; instructions given in pwhash.php. - - - -[aliases] - -; Alias expansion. Change the two examples as needed and add your own -; favorites --- feel free to suggest more defaults! The command line you -; enter will only be expanded on the very first token and only once, so having -; 'ls' expand into 'ls -CvhF' does not cause an infinite recursion. - -ls = "ls -CvhF" -ll = "ls -lvhF" - - - -[settings] - -; General settings for PHP Shell. - -; Home directory. PHP Shell will change to this directory upon startup and -; whenever a bare 'cd' command is given. This can be an absolute path or a -; path relative to the PHP Shell installation directory. - -home-directory = "." +; <?php die('Forbidden'); ?> +; Do not remove the above line, it prevents this file from being downloaded. +; +; config.php file for PHP Shell @VERSION@ +; Copyright (C) 2005, 2006 Martin Geisler <mge...@mg...> +; Licensed under the GNU GPL. See the file COPYING for details. + +; This ini-file has three parts: +; +; * [users] where you add usernames and passwords to give users access to PHP +; Shell. +; +; * [aliases] where you can configure shell aliases. +; +; * [settings] where general settings are placed. + + +[users] + +; The default configuration has no users defined, you have to add your own +; (choose good passwords!). Add uses as simple 'username = "password"' lines. +; Please quote your password using double-quotes as shown. The semi-colon ':' +; is a reserved character, so do *not* use that in your passwords. +; +; For improved security it is *strongly suggested* that you the pwhash.php +; script to generate a hashed password and store that instead of the normal +; clear text password. Keeping your passwords in hashed form ensures that +; they cannot be found, even if this file is disclosed. The passwords are +; still visible in clear text during the login, though. Please follow the +; instructions given in pwhash.php. + + + +[aliases] + +; Alias expansion. Change the two examples as needed and add your own +; favorites --- feel free to suggest more defaults! The command line you +; enter will only be expanded on the very first token and only once, so having +; 'ls' expand into 'ls -CvhF' does not cause an infinite recursion. + +ls = "ls -CvhF" +ll = "ls -lvhF" + + + +[settings] + +; General settings for PHP Shell. + +; Home directory. PHP Shell will change to this directory upon startup and +; whenever a bare 'cd' command is given. This can be an absolute path or a +; path relative to the PHP Shell installation directory. + +home-directory = "." Index: style.css =================================================================== RCS file: /cvsroot/phpshell/phpshell/style.css,v retrieving revision 1.1 retrieving revision 1.2 diff -u -d -r1.1 -r1.2 --- style.css 13 Jan 2006 17:49:45 -0000 1.1 +++ style.css 13 Jan 2006 17:59:28 -0000 1.2 @@ -1,4 +1,4 @@ -/* style.css file for PHP Shell 2.1 +/* style.css file for PHP Shell @VERSION@ * Copyright (C) 2003-2005 Martin Geisler <mge...@mg...> * Licensed under the GNU GPL. See the file COPYING for details. */ Index: INSTALL =================================================================== RCS file: /cvsroot/phpshell/phpshell/INSTALL,v retrieving revision 1.6 retrieving revision 1.7 diff -u -d -r1.6 -r1.7 --- INSTALL 13 Jan 2006 17:49:45 -0000 1.6 +++ INSTALL 13 Jan 2006 17:59:28 -0000 1.7 @@ -1,4 +1,4 @@ -INSTALL file for PHP Shell 2.1 +INSTALL file for PHP Shell @VERSION@ Copyright (C) 2000-2005 Martin Geisler <mge...@mg...> Licensed under the GNU GPL. See the file COPYING for details. @@ -17,7 +17,7 @@ Installation is easy: first unpack the tarball or zipfile downloaded from the above website into your webserver. This will create a subdirectory called -phpweather-2.1 for PHP Shell version 2.1. +phpweather-@VERSION@ for PHP Shell version @VERSION@. Try loading the file ``phpshell.php`` in your browser and check that you are served a page that asks you to authenticate yourself with a username and a Index: pwhash.php =================================================================== RCS file: /cvsroot/phpshell/phpshell/pwhash.php,v retrieving revision 1.1 retrieving revision 1.2 diff -u -d -r1.1 -r1.2 --- pwhash.php 13 Jan 2006 17:49:45 -0000 1.1 +++ pwhash.php 13 Jan 2006 17:59:28 -0000 1.2 @@ -1,6 +1,6 @@ <?php /* - * pwhash.php file for PHP Shell 2.1 + * pwhash.php file for PHP Shell @VERSION@ * Copyright (C) 2005 Martin Geisler <mge...@mg...> * Licensed under the GNU GPL. See the file COPYING for details. */ @@ -23,13 +23,13 @@ "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> - <title>Password Hasher for PHP Shell 2.1</title> + <title>Password Hasher for PHP Shell @VERSION@</title> <link rel="stylesheet" href="style.css" type="text/css"> </head> <body> -<h1>Password Hasher for PHP Shell 2.1</h1> +<h1>Password Hasher for PHP Shell @VERSION@</h1> <form action="<?php $_SERVER['PHP_SELF']; ?>" method="POST"> Index: phpshell.php =================================================================== RCS file: /cvsroot/phpshell/phpshell/phpshell.php,v retrieving revision 1.7 retrieving revision 1.8 diff -u -d -r1.7 -r1.8 --- phpshell.php 13 Jan 2006 17:49:45 -0000 1.7 +++ phpshell.php 13 Jan 2006 17:59:28 -0000 1.8 @@ -3,14 +3,14 @@ /* ************************************************************** - * PHP Shell 2.1 * + * PHP Shell @VERSION@ * ************************************************************** PHP Shell is an interactive PHP script that will execute any command entered. See the files README, INSTALL, and SECURITY or http://mgeisler.net/php-shell/ for further information. - Copyright (C) 2000-2005 Martin Geisler <mge...@mg...> + Copyright (C) 2000-2006 Martin Geisler <mge...@mg...> This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License @@ -46,7 +46,7 @@ "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> - <title>PHP Shell 2.1</title> + <title>PHP Shell @VERSION@</title> <link rel="stylesheet" href="style.css" type="text/css"> </head> <body> @@ -270,7 +270,7 @@ "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> - <title>PHP Shell 2.1</title> + <title>PHP Shell @VERSION@</title> <link rel="stylesheet" href="style.css" type="text/css"> <script type="text/javascript"> @@ -315,7 +315,7 @@ <body onload="init()"> -<h1>PHP Shell 2.1</h1> +<h1>PHP Shell @VERSION@</h1> <form name="shell" action="<?php echo $_SERVER['PHP_SELF'] ?>" method="post"> Index: SECURITY =================================================================== RCS file: /cvsroot/phpshell/phpshell/SECURITY,v retrieving revision 1.1 retrieving revision 1.2 diff -u -d -r1.1 -r1.2 --- SECURITY 13 Jan 2006 17:49:45 -0000 1.1 +++ SECURITY 13 Jan 2006 17:59:28 -0000 1.2 @@ -1,89 +1,93 @@ -SECURITY file for PHP Shell 2.1 -Copyright (C) 2005 Martin Geisler <mge...@mg...> +SECURITY file for PHP Shell @VERSION@ +Copyright (C) 2005, 2006 Martin Geisler <mge...@mg...> Licensed under the GNU GPL. See the file COPYING for details. PHP Security ============ -Installing PHP on your server is an inheriently dangerous thing to do, -somewhat similar to the danger one faces when one buys a car: it might kill -you if you have an accident. On the other hand a car makes so many things so -much more convenient, so most people are willing to accept the risk of -accidents. +Installing PHP on your server is an inherently dangerous thing to do, +somewhat similar to the danger one faces when one buys a car: it might +kill you if you have an accident. On the other hand a car makes so +many things so much more convenient, so most people are willing to +accept the risk of accidents. -Likewise, PHP is a powerful tool which will let you build your webpages easier -and faster than without. But it is a *very* powerful tool --- PHP is a full -programming language which can be used for general purpose programming and not -just to format HTML for display in a browser. +Likewise, PHP is a powerful tool which will let you build your +webpages easier and faster than without. But it is a *very* powerful +tool --- PHP is a full programming language which can be used for +general purpose programming and not just to format HTML for display in +a browser. -So PHP has support for reading and writing files on the filesystem. But PHP -also has support for *deleting* files. PHP even has support for executing -other programs. In other words, PHP has lots of support for interacting with -the rest of the computer it runs on. This interaction is potentially much -more powerful than you want it to, and this can be a problem if this power -ends up in the wrong hands. +So PHP has support for reading and writing files on the filesystem. +But PHP also has support for *deleting* files. PHP even has support +for executing other programs. In other words, PHP has lots of support +for interacting with the rest of the computer it runs on. This +interaction is potentially much more powerful than you want it to, and +this can be a problem if this power ends up in the wrong hands. What about Safe Mode? --------------------- -As they note in the PHP manual, Safe Mode is an inherently wrong way to secure -PHP, but is nevertheless used in many installations. Turning Safe Mode on in -PHP basically tries to restrict the language and its functions to make it -"safe". +As they note in the PHP manual, Safe Mode is an inherently wrong way +to secure PHP, but is nevertheless used in many installations. +Turning Safe Mode on in PHP basically tries to restrict the language +and its functions to make it "safe". -This involves a strict check on file ownership so that PHP wont operate on -files and directories which are not owned by the owner of the current script. -Other restrictions in Safe Mode include limits on which files can be executed -and includes (thus making a primitive form of chroot or jail around the PHP -script). +This involves a strict check on file ownership so that PHP wont +operate on files and directories which are not owned by the owner of +the current script. Other restrictions in Safe Mode include limits on +which files can be executed and includes (thus making a primitive form +of chroot or jail around the PHP script). PHP Shell is made mostly useless with Safe Mode since it restricts the two commands that PHP Shell uses: ``chdir()`` and ``proc_open()``: -* With Safe Mode you cannot change to a directory unless you are the owner of - that directory. This means that you cannot change to, say, ``/etc`` since - ``root`` own that directory. +* With Safe Mode you cannot change to a directory unless you are the + owner of that directory. This means that you cannot change to, say, + ``/etc`` since ``root`` own that directory. You'll see this when 'cd /etc' results in this error from PHP Shell: - chdir(): SAFE MODE Restriction in effect. The script whose uid is 500 is - not allowed to access /etc owned by uid 0 - cd: could not change to: /etc + chdir(): SAFE MODE Restriction in effect. The script whose uid is + 500 is not allowed to access /etc owned by uid 0 cd: could not + change to: /etc -* When Safe Mode is active, PHP forces the argument to ``proc_open()`` to be - escaped, which means that you cannot use normal shell wildcards, pipes or - any such stuff. +* When Safe Mode is active, PHP forces the argument to ``proc_open()`` + to be escaped, which means that you cannot use normal shell + wildcards, pipes or any such stuff. - So if you enter 'ls *.txt' in a directory where you know for certain that - there is a text file ending in '.txt', you will get the following error: + So if you enter 'ls *.txt' in a directory where you know for certain + that there is a text file ending in '.txt', you will get the + following error: /bin/ls: *.txt: No such file or directory - This is because PHP has silently changed the command into 'ls \*.txt' to - disable the wildcard. + This is because PHP has silently changed the command into 'ls + \*.txt' in order to disable the wildcard. There is nothing PHP + Shell can do about this. -* You cannot execute programs unless they are placed in a directory listed in - ``safe_mode_exec_dir``. Say you want to execute the program ``tr`` (which - translates between sets of characters) and you get this strange messages - back: +* You cannot execute programs unless they are placed in a directory + listed in ``safe_mode_exec_dir``. Say you want to execute the + program ``tr`` (which translates between sets of characters) and you + get this strange messages back: sh: line 1: /bin/tr: No such file or directory - Then you have a problem with the ``safe_mode_exec_dir`` setting. In this - case ``safe_mode_exec_dir`` is set to just ``/bin`` and so PHP has forced - the shell to execute ``/bin/tr`` and since ``tr`` is installed in - ``/usr/bin`` it could not be found. + Then you have a problem with the ``safe_mode_exec_dir`` setting. In + this case ``safe_mode_exec_dir`` is set to just ``/bin`` and so PHP + has forced the shell to execute ``/bin/tr`` and since ``tr`` is + installed in ``/usr/bin`` it could not be found. - If you have write access to a directory listed in ``safe_mode_exec_dir``, - then try copying the wanted program there first. Executing it should now - work. + If you have write access to a directory listed in + ``safe_mode_exec_dir``, then try copying the wanted program there + first. Executing it should now work. -Even without enabling Safe Mode some functions might have been disabled via -the ``disabled_functions`` setting. If the ``proc_open()`` function used by -PHP Shell has been disabled, then you will see an error like this: +Even without enabling Safe Mode some functions might have been +disabled via the ``disabled_functions`` setting. If the +``proc_open()`` function used by PHP Shell has been disabled, then you +will see an error like this: Fatal Error! @@ -96,40 +100,81 @@ PHP Shell Security ================== -As noted above, PHP is a powerful tool --- how does PHP Shell fit into this? -PHP Shell is actually quite simple and does one thing: it uses the standard -PHP function ``proc_open()`` to execute programs. +As noted above, PHP is a powerful tool --- how does PHP Shell fit into +this? PHP Shell is actually quite simple and does one thing: it uses +the standard PHP function ``proc_open()`` to execute programs. -Executing other programs is probably the most powerful thing you can do in -PHP, and so PHP Shell gives you a convenient interface to this the most -powerful feature of PHP. Nothing more. +Executing other programs is probably the most powerful thing you can +do in PHP, and so PHP Shell gives you a convenient interface to this +the most powerful feature of PHP. Nothing more. Is PHP Shell Dangerous? ----------------------- -Short answer: *yes*! PHP Shell has been used in the past by people with -not-so-good intentions to destroy valuable content on servers. +Short answer: *yes*! PHP Shell has been used in the past by people +with not-so-good intentions to destroy valuable content on servers. -The longer answer is that installing PHP Shell is like building a new door in -your house --- if you leave it unlocked, then people can (and probably will!) -walk into it and steal your posessions. So you want to lock it, and make sure -you use a good lock. +The longer answer is that installing PHP Shell is like building a new +door in your house --- if you leave it unlocked, then people can (and +probably will!) walk into it and steal your possessions. So you want +to lock it, and make sure you use a good lock. -With PHP Shell that is equivalent of using a secure password. A secure -password is one which is hard to guess (make it long, make it random, and put -both numbers, special characters and normal letters in it). +With PHP Shell that is equivalent of using a secure password. A +secure password is one which is hard to guess (make it long, make it +random, and put both numbers, special characters and normal letters in +it). - Remember that guessing the password is all that stands between the crackers - and your files! + Remember that guessing the password is all that stands between the + crackers and your files! -If you use a good password, then PHP Shell does not make your system any more -unsecure than it already was. Security is always a matter of finding the -weakest link in the chain: if you use FTP with a simple password for updating -your site, then it would be much easier for the crackers to attack that -instead of trying to guess your super-hard PHP Shell password. So make sure -that you tighten security on all fronts you know of. +If you use a good password, then PHP Shell does not make your system +any more insecure than it already was. Security is always a matter of +finding the weakest link in the chain: if you use FTP with a simple +password for updating your site, then it would be much easier for the +crackers to attack that instead of trying to guess your super-hard PHP +Shell password. So make sure that you tighten security on all fronts +you know of. +Other Threats +------------- + +Aside the obvious threat of someone guessing your password as +discussed above, there is another threat when using PHP Shell: all +communication is done in clear text! + +This means that anybody who is able to intercept the traffic between +your browser and the server will receive the password, all the +commands you type, and all the output of those commands. Using hashed +passwords makes no difference here, the password is still sent in the +clear and is only hashed after having arrived at the server. + +With a normal network setup your traffic will go through a number of +intermediate nodes before reaching its goal. For example, when my +browser sends the password, it has to go through no less than 15 +computers before reaching the server. Any of those computers could +potentially save the traffic for later analysis and so save the +password. + +So counter this threat you can establish an encrypted connection +between the browser and the server. This is called an SSL (Secure +Socket Layer) connection and one runs HTTPS (Secure HTTP) over it. + +Unfortunately you cannot just create such a connection without first +installing a SSL certificate on the server, something which the server +administrator will have to do for you. Furthermore, a real SSL +certificate costs money, and if you are willing to pay for such a +certificate, then you are probably also willing to pay for a quality +host which offers SSH access. + +So: SSL is the answer to the threat of eavesdropping, but if you have +SSL available, then you probably also have SSH available, and thus no +need for PHP Shell --- a funny chicken-and-egg problem :-) + + +Feedback +======== + If you have suggestions for improvements to this little guide in system security, then please do not hesitate to contact <mge...@mg...>. |
