PHP Security Information

    PHP contains several functions that allow you to execute system commands from within your PHP code. When a computer cracker locates a vulnerability in a PHP script they will generally use these functions to gain access to your account. Even if the script itself does not use these functions, the vulnerability will allow the cracker to supply code to be run in your account. Because new vulnerabilities will continue to be found and exploited in popular software, we take a proactive approach toward ensuring your account remains secure.

    The functions "proc_open", "system", "cmd", "shell_exec", and "passthru" are disabled by default when PHP is installed in your VPS (using `backticks` to execute a command is an alias for the function shell_exec). The function "popen" can also be used to execute system commands, but because it is relied upon in several of the Site Applications it is not being disabled by default. Should a cracker attempt to exploit a vulnerability in a PHP script in your account then not having access to these functions will make it extremely difficult for them to execute their malicious code.

Enabling the functions you need

    PHP 4.4.x and PHP 5.0.x

    With our release of PHP 4.4, 4.4.1, 5.0.3, and 5.0.5 we have included the capability of changing which functions are disabled when it is installed. If you need to modify this in the future you can click on the 'edit' icon in the 'Site Applications' section for PHP 4.4.x, and PHP 5.0.x.

    Other versions of PHP

    If you are using any other version of PHP than those listed above, you will need to manually enable these functions by modifying the file '/etc/php.ini' in your VPS. You can do this online using your File Manager, at http://yourdomain.com/fm/ (make sure that you replace yourdomain.com with your domain name).

    You will see the following line approximately 1/5th of the way through the file. Note that it may or may not contain the exact functions we have listed in this example:

disable_functions = system, cmd, shell_exec, proc_open, passthru

    Remove the name of the functions to allow them to be used in your PHP code. This change will not take effect until Apache, the webserver, is restarted.

    Restarting your VPS

    The easiest way to restart Apache is to restart your VPS by logging into your Site Manager at http://www.yourdomain.com/manager/ (make sure that you replace yourdomain.com with your domain name) and following these three steps:

    1. Click on the Restart Account link from the Account Settings section of the left nav bar.
    2. Click the Restart button.
    3. A window will open prompting you to verify the restart, click the OK button to continue, or the Cancel button to cancel the restart.

Determining whether or not you are using these functions

    Most PHP applications do not need these functions to run. None of the site applications that we provide will be effected if these functions are disabled. However, if you are not sure whether or not you are using these functions here is a command that you can run using the 'Execute a Shell Command' feature of your File Manager:

find /var 2>/dev/null -type f -name '*php' -exec grep -nHE '[^a-zA-Z_0-9](system|cmd|proc_open|shell_exec|passthru) ?\(' {} \;

    NOTE: It is critical that this is typed in without any errors for it to work.

    This will scan all of your website files that end in the extension 'php' and search them for any use of these functions. If any of these functions are found then the file name, line number the function was found, and the matching line of code will be displayed. The first command will search for the functions by name, and will find the vast majority of their occurances. Because words are often quoted with backticks in comments and SQL queries it is very difficult to automatically determine when backticks are being used to run a system command.

    If you have a large website, it may take a long time for this to run! There is no perfect method for detecting the use of these functions, but this will provide you with a very good indication of whether or not you are even using these functions. If you need any help with this please contact technical support.