The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Ok, how dangerous is shell_exec really?

Discussion in 'General Discussion' started by jols, Sep 11, 2007.

  1. jols

    jols Well-Known Member

    Joined:
    Mar 13, 2004
    Messages:
    1,111
    Likes Received:
    2
    Trophy Points:
    38
    Apparently Fantastico can not un-install a package if shell_exec is switched off.

    No we do not phpsuexec installed.

    Yes, we do have open_basedir restrictions enabled, along with many other security features.


    Should I be concerned about switching on shell_exec just so our Fantastico users can do their un-installs?
     
  2. jols

    jols Well-Known Member

    Joined:
    Mar 13, 2004
    Messages:
    1,111
    Likes Received:
    2
    Trophy Points:
    38
    Anyone? Any thoughts?
     
  3. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    It's up to you to judge the benefits against the disadvantages. Turning the function off helps protect vulnerably/poorly coded PHP web scripts installed on the server, especially in a non-phpsuexec/suphp environment. The advantage of not disabling it is that fantastico functions. If you'd prefer to leave it disabled, I'd suggest lobbying netenberg.com to code their removal scripts using php functions instead of relying on shell.
     
  4. mrprez

    mrprez Well-Known Member

    Joined:
    Jun 14, 2002
    Messages:
    93
    Likes Received:
    0
    Trophy Points:
    16
    Another advantage is that users will be more likely to remove unwanted scripts rather than leaving them sit there not being used or updated. This to me causes more security issues than having shell_exec activated.
     
  5. brianoz

    brianoz Well-Known Member

    Joined:
    Mar 13, 2004
    Messages:
    1,146
    Likes Received:
    6
    Trophy Points:
    38
    Location:
    Melbourne, Australia
    cPanel Access Level:
    Root Administrator
    Isn't it possible to switch on shell_exec just for Fantastico?

    Regardless I wouldn't allow shell_exec() without suphp or phpsuexec (but then I wouldn't allow PHP without suphp or phpsuexec!).
     
  6. jols

    jols Well-Known Member

    Joined:
    Mar 13, 2004
    Messages:
    1,111
    Likes Received:
    2
    Trophy Points:
    38
    I only wish this were the case.

    Netenberg says that you must switch shell_exec on for the entire server just so Fantastico can un-install packages. IMO this is by far the worst thing about Fantastico.
     
  7. brianoz

    brianoz Well-Known Member

    Joined:
    Mar 13, 2004
    Messages:
    1,146
    Likes Received:
    6
    Trophy Points:
    38
    Location:
    Melbourne, Australia
    cPanel Access Level:
    Root Administrator
    That sounds like a generic answer, I'd want to dig further. As far as I know the version of PHP that runs for WHM is a different binary? Maybe it runs as mod_php? If so, you could use a .htaccess file and php_flag settings to enable shell_exec. If not, you could probably add a php.ini file somewhere else.
     
  8. verdon

    verdon Well-Known Member

    Joined:
    Nov 1, 2003
    Messages:
    836
    Likes Received:
    2
    Trophy Points:
    18
    Location:
    Northern Ontario, Canada
    cPanel Access Level:
    Root Administrator
    or just avoid fantastico altogether ;)
     
  9. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    14,446
    Likes Received:
    195
    Trophy Points:
    63
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    Well, that's not exactly what they said to you.


    http://www.netenberg.com/forum/index.php?topic=6132.0



    Either suggestion sound like sound ideas to me.

    And I agree with MaraBlue in that thread. No problems here to speak of. (so far to date)
     
Loading...

Share This Page