c99, r57, x-shell ...

[jazz1611]

Hi,

How can i disable shell php (c99, r57, x-shell, cgi shell ....)? There is backdoor php. We dont like it have on server, right.

Regards,

 

[quizknows]

These usually get in through old CMS software that was never updated. If you find these in an account it's usually safe to say that person either had a really weak password for their CMS (wordpress, joomla, etc)., or they were running an old version of one of those softwares with bad/old components.

A couple things that help these to not get in, and also help cripple their functionality:

Use a good mod_security ruleset. I recommend either atomicorp ("gotroot") or Trustwave's managed rules.

Disable these functions in php.ini:

disable_functions = shell_exec,show_source,system,passthru,exec,phpinfo,popen,proc_open,allow_url_fopen,ini_set

(some hackers may place their own php.ini to bypass this, but many shells will not work well with shell_exec and passthru disabled.)

 

[jazz1611]

Hi,

I used rules in there Security Update: Atomic Mod Security setup guide for cPanel | UKHost4u Blog and added disable_functions you give. I installed Antimalware Plugin for WHM. Now my friend cant hack or use shell php. Love it.

P/s: Give us tutorial for anti shell php better.

Regards,

 

[HostingH]

Hi,

For server security, I would like to suggest, use CageFS. According to CloudLinux, CageFS “is a virtualized file system and a set of tools to contain each user in its own ‘cage’. Each customer will have its own fully functional CageFS, with all the system files, tools, etc”.

 

[24x7server]

You can install Linux Malware Detect (LMD) and ConfigServer eXploit Scanner (cxs) on your server because these both plugins will detect the PHP CMD shell files on your server

Linux Malware Detect | R-fx Networks
ConfigServer eXploit Scanner (cxs)

 

[cPanelMichael]

Hello

You may also find the following thread useful if you are using suPHP:

Methods to Increase Security with suPHP

Thank you.

 

[shashank]

Malware detect should help you a lot. Also, making sure your scripts on the servers are up to date is also very important.

 

[rlshosting]

Hello

You may also find the following thread useful if you are using suPHP:

Methods to Increase Security with suPHP

Thank you.

Can this be applied to mod_ruid2? Thank you.

 

[cPanelMichael]

Can this be applied to mod_ruid2? Thank you.

The methods on that thread are intended for suPHP. Mod_Ruid2 is an Apache extension, whereas suPHP is a PHP handler.

Thank you.

 

[rlshosting]

Thank you.