The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Ok, how dangerous is shell_exec really?

Discussion in 'General Discussion' started by jols, Sep 11, 2007.

  1. jols

    jols Well-Known Member

    Joined:
    Mar 13, 2004
    Messages:
    1,111
    Likes Received:
    2
    Trophy Points:
    168
    Apparently Fantastico can not un-install a package if shell_exec is switched off.

    No we do not phpsuexec installed.

    Yes, we do have open_basedir restrictions enabled, along with many other security features.


    Should I be concerned about switching on shell_exec just so our Fantastico users can do their un-installs?
     
    #1 jols, Sep 11, 2007
  2. jols

    jols Well-Known Member

    Joined:
    Mar 13, 2004
    Messages:
    1,111
    Likes Received:
    2
    Trophy Points:
    168
    Anyone? Any thoughts?
     
    #2 jols, Sep 12, 2007
  3. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,472
    Likes Received:
    20
    Trophy Points:
    463
    Location:
    Go on, have a guess
    It's up to you to judge the benefits against the disadvantages. Turning the function off helps protect vulnerably/poorly coded PHP web scripts installed on the server, especially in a non-phpsuexec/suphp environment. The advantage of not disabling it is that fantastico functions. If you'd prefer to leave it disabled, I'd suggest lobbying netenberg.com to code their removal scripts using php functions instead of relying on shell.
     
    #3 chirpy, Sep 12, 2007
  4. mrprez

    mrprez Well-Known Member

    Joined:
    Jun 14, 2002
    Messages:
    93
    Likes Received:
    0
    Trophy Points:
    166
    Another advantage is that users will be more likely to remove unwanted scripts rather than leaving them sit there not being used or updated. This to me causes more security issues than having shell_exec activated.
     
    #4 mrprez, Oct 16, 2007
  5. brianoz

    brianoz Well-Known Member

    Joined:
    Mar 13, 2004
    Messages:
    1,146
    Likes Received:
    6
    Trophy Points:
    168
    Location:
    Melbourne, Australia
    cPanel Access Level:
    Root Administrator
    Isn't it possible to switch on shell_exec just for Fantastico?

    Regardless I wouldn't allow shell_exec() without suphp or phpsuexec (but then I wouldn't allow PHP without suphp or phpsuexec!).
     
    #5 brianoz, Oct 20, 2007
  6. jols

    jols Well-Known Member

    Joined:
    Mar 13, 2004
    Messages:
    1,111
    Likes Received:
    2
    Trophy Points:
    168
    I only wish this were the case.

    Netenberg says that you must switch shell_exec on for the entire server just so Fantastico can un-install packages. IMO this is by far the worst thing about Fantastico.
     
    #6 jols, Oct 21, 2007
  7. brianoz

    brianoz Well-Known Member

    Joined:
    Mar 13, 2004
    Messages:
    1,146
    Likes Received:
    6
    Trophy Points:
    168
    Location:
    Melbourne, Australia
    cPanel Access Level:
    Root Administrator
    That sounds like a generic answer, I'd want to dig further. As far as I know the version of PHP that runs for WHM is a different binary? Maybe it runs as mod_php? If so, you could use a .htaccess file and php_flag settings to enable shell_exec. If not, you could probably add a php.ini file somewhere else.
     
    #7 brianoz, Oct 21, 2007
  8. verdon

    verdon Well-Known Member

    Joined:
    Nov 1, 2003
    Messages:
    841
    Likes Received:
    2
    Trophy Points:
    168
    Location:
    Northern Ontario, Canada
    cPanel Access Level:
    Root Administrator
    or just avoid fantastico altogether ;)
     
    #8 verdon, Oct 21, 2007
  9. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    15,553
    Likes Received:
    291
    Trophy Points:
    433
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    Well, that's not exactly what they said to you.


    http://www.netenberg.com/forum/index.php?topic=6132.0



    Either suggestion sound like sound ideas to me.

    And I agree with MaraBlue in that thread. No problems here to speak of. (so far to date)
     
    #9 Infopro, Oct 21, 2007
(You must log in or sign up to post here.)
Loading...
Similar Threads - dangerous shell_exec really
  1. keat63

    Attachments: Filter messages with dangerous attachments

    keat63, Feb 23, 2017, in forum: E-mail Discussions
    Replies:
    5
    Views:
    525
    cPanelMichael
    Feb 28, 2017
  2. VMunich

    Is it possible to whitelist command/programs to be used by shell_exec?

    VMunich, Jul 3, 2017, in forum: Security
    Replies:
    4
    Views:
    81
    quizknows
    Jul 4, 2017
  3. sathyasam

    shell_exec not working

    sathyasam, Oct 1, 2016, in forum: General Discussion
    Replies:
    1
    Views:
    289
    cPanelMichael
    Oct 6, 2016
  4. postcd

    shell_exec() has been disabled for security reasons in /usr/local/cpanel/whostmgr/.../logger.php

    postcd, Sep 20, 2015, in forum: General Discussion
    Replies:
    6
    Views:
    956
    cPanelMichael
    Sep 29, 2015
  5. Nazmul Hasan

    Cannot execute shell_exec function

    Nazmul Hasan, Aug 30, 2015, in forum: General Discussion
    Replies:
    5
    Views:
    679
    mageshm
    Oct 27, 2015

Share This Page