How to protect from perl scripts?

[gvard]

Greetings from Greece,

I've been watching the forum for over a year now and I've:

1) mounted /tmp with no executable rights
2) chmoded wget to 700

Of course I've added many other security measures (hired a technician, APF, etc).

My question is the following: I saw last night a script which was run as "perl script.txt", which executed some code (which didn't have any success).


How do we prevent users from running exploits via "perl -exploit-" command? Is there any way to disable the command "perl" for user "nobody" in the /tmp and /dev/shm folders?

[dropby23]

you should use a kernel based solution like gr-security or search more about posix acl's

[chirpy]

Generally speaking, though, there's little that you can realistically do as most measures are easily bypassed - such are the risks with shared web hosting. Your best efforts are probably to make sure that you don't have vulnerable scripts installed on the server (in particular php scripts since you're talking about them running under the nobody account) and installing mod_Security and using a good set of filters.