Quote:
Originally Posted by Angel-Wings
Simple answer - use a different temp dir than the default /tmp one, chown / chmod that one and make sure anything active (PHP, SSI) isn't active there.
Related to the VPS issue and the "It's up to you" statement - that's only partially right. VPS run inside a virtual environment and if the hoster doesn't care about security updates it's possible - hard but possible - to break out from a VPS on the real server and from there, well, you can do everything.
Back to the "tmp dir" - set in php.ini a tempdir, outside the webroot of course and ensure your Webserver doesn't serve that directory.
And related to this base64 - I highly recommend reading some manuals about a "secure as possible" PHP setup. Just because it's set in the default php.ini, it doesn't mean it's good to be kept  |
Chown it as a different user other than root?
04-13-2009, 02:58 AM
Hybrid Mode
