PHP.INI settings: Disable exec, shell_exec, system, popen and Other Functions To Improve Security

Posted on in Categories , , , last updated July 18, 2015

I run a small Apache based web-server for my personal use, and it is shared with friends and family. However, most script kiddie try to exploit php application such as WordPress using exec(), passthru(), shell_exec(), system() functions. How do I disable these functions to improve my php script security?

PHP has a lot of functions which can be used to crack your server if not used properly. You can set list of functions in php.ini using disable_functions directive. This directive allows you to disable certain functions for security reasons. It takes on a comma-delimited list of function names. disable_functions is not affected by Safe Mode. This directive must be set in php.ini file. For example, you cannot set this in httpd.conf file.

Open a terminal or login to your server over the ssh session. Open php.ini file:
# vi /etc/php.ini
Find disable_functions and set new list as follows:

disable_functions =exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source

I also recommend to disable allow_url_include and allow_url_fopen for security reasons:

allow_url_fopen=Off
allow_url_include=Off

Save and close the file. Restart the httpd server by tying the following command:
# service httpd restart
OR if you are using Debian/Ubuntu Linux, run:
# service apache2 restart

A note about systemd based system

If you are using systemd + RHEL/CentOS/Fedora Linux based system, enter:
# systemctl httpd restart
If you are using systemd + Debian/Ubuntu Linux based system, enter:
# systemctl restart apache2

See also:
  • Linux: 25 PHP Security Best Practices For Sys Admins – A misconfigured server-side scripting language can create all sorts of problems. So, PHP should be used with caution. Here are twenty-five php security best practices for sysadmins for configuring PHP securely.

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin and a trainer for the Linux operating system/Unix shell scripting. He has worked with global clients and in various industries, including IT, education, defense and space research, and the nonprofit sector. Follow him on Twitter, Facebook, Google+.

Share this on:

32 comment

    1. I can’t understand if they can be re-enabled in scripts why should we disable them? hackers may use ini_set() to enable them! Or is there any restrictions/limits for hackers while calling ini_set() that I don’t know?

      Reply Report comment

  7. readfile() and file_get_contents() functions are subject to the open_basedir restriction.
    Obviously you should set the open_basedir php setting to your docroot, so the scripts won’t be able to read files above docroot in your file system!

    Reply Report comment

  9. “ubuntu lover”: Either you want to disable those functions or not. If you want you have to change php.ini: overwrite disable_functions and set a new list or modify the existing one. I’m not sure you think it makes it useless. Only the server admin can do that and he will only disable the functions he wants, editing that list.
    Also Eric says: “if you really need those functions, you can overwrite the configuration using ini_set function in your script to enable them for a particular site.” But again you can do that only on the server side.

    Reply Report comment

  13. Here is the list i use. Most script dont use any of these functions anyway (except for chmod maybe, for file management script or something).

    exec, passthru, shell_exec, system, proc_open, posix_mkfifo, pg_lo_import, dbmopen, dbase_open, popen, chgrp, chown, chmod, symlink, pcntl_exec,
    apache_child_terminate, apache_setenv, define_syslog_variables, posix_getpwuid, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid,
    posix_setuid, posix_uname, proc_close, pclose, proc_nice, proc_terminate, shell_exec

    Reply Report comment

  14. only disable those setting,it it enough ? how about the following too over ?

    disable_functions = show_source, system, shell_exec, passthru, exec, popen, proc_open, allow_url_fopen, phpinfo, gzinflate, fsockopen, pfsockopen
    Reply Report comment

  16. Best one I could found is this :

    #Protect your website from Hacking using this php.ini By Mauritania Attacker

    safe_mode = On
disable_functions = "ln, cat, popen, pclose, posix_getpwuid, posix_getgrgid, posix_kill, parse_perms, system, dl, passthru, exec, shell_exec, popen, proc_close, proc_get_status, proc_nice, proc_open, escapeshellcmd, escapeshellarg, show_source, posix_mkfifo, mysql_list_dbs, get_current_user, getmyuid, pconnect, link, symlink, pcntl_exec, ini_alter, pfsockopen, leak, apache_child_terminate, posix_kill, posix_setpgid, posix_setsid, posix_setuid, proc_terminate, syslog, fpassthru, stream_select, socket_select, socket_create, socket_create_listen, socket_create_pair, socket_listen, socket_accept, socket_bind, socket_strerror, pcntl_fork, pcntl_signal, pcntl_waitpid, pcntl_wexitstatus, pcntl_wifexited, pcntl_wifsignaled, pcntl_wifstopped, pcntl_wstopsig, pcntl_wtermsig, openlog, apache_get_modules, apache_get_version, apache_getenv, apache_note, apache_setenv, virtual, chmod, file_upload, delete, deleted, edit, fwrite, cmd, rename, unlink, mkdir, mv, touch, cp, cd, pico"
safe_mode_gid = On
open_basedir = On
register_globals = Off
exec = Off
shell_exec = Off
allow_url_fopen = Off
allow_url_include = Off
    Reply Report comment

  17. Hello Experts,
    i have a problem i have installed mysql and lamp on my fedora linux .
    i have configured phpmyadmin also so that it can connect to the mysql socket.
    all works with http://localhost/ and http://localhost/phpmyadmin in the browser …
    but when i tried running my db.php file which contains following

    give me errors
    Warning: mysql_connect(): No such file or directory in /opt/lampp/htdocs/hellophp/index.php on line 2
    No such file or directory

    this works fine on my windows but not on linux although all configuration of lampp is fine..help

    Reply Report comment

  20. This article is laughable at best. Sure, the functions mentioned can be used to exploit security issues, but if your server is properly configured, you shouldn’t need to do so.

    exec, passthru, shell_exec, system, proc_open and popen are all dependent on server permissions. If your server is configured properly, the user accounts should not be able to do anything dangerous with these.

    curl_exec and curl_multi_exec are both quite useful. I don’t see how these can be dangerous.

    parse_ini_file and show_source are both completely harmless. I highly recommend you read up on what these do before you go blindly recommending people disable them.

    Reply Report comment

    1. Maybe these restrictions are useful on servers where different webspace users (i.e. actual people) “share” one UNIX user account (separate accounts only on the FTP server etc.). IIRC this is the case in typical Apache installations (all PHP scripts run as user “apache”, and there are no separate PHP interpreter processes being created which could get their user ID changed).
      So if PHP scripts were allowed full access, the FTP server’s restrictions would become useless. (But still then you need to disable CGI, otherwise one can upload and execute shell scripts…)

      Reply Report comment

  21. I use this list:

    apache_child_terminate, apache_setenv, define_syslog_variables, escapeshellarg, escapeshellcmd, eval, exec, fp, fput, ftp_connect, ftp_exec, ftp_get, ftp_login, ftp_nb_fput, ftp_put, ftp_raw, ftp_rawlist, highlight_file, ini_alter, ini_get_all, ini_restore, inject_code, openlog, passthru, php_uname, phpAds_remoteInfo, phpAds_XmlRpc, phpAds_xmlrpcDecode, phpAds_xmlrpcEncode, popen, posix_getpwuid, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid, posix_setuid, posix_uname, proc_close, proc_get_status, proc_nice, proc_open, proc_terminate, shell_exec, show_source, syslog, system, xmlrpc_entity_decode, ini_set

    Works fine.

    Thanks.

    Reply Report comment

  24. Those who advising to disable ‘eval’ should read PHP documentation and understand that language instead of blindly copy-paste “smart” advises and reporting without testing that it’s “works good” for them.

    Eval – is a language construct(same as ‘echo’) and CAN NOT be disabled without third party extension such as Suhosin

    Reply Report comment

Leave a Comment

Tagged as: Tags , , , , , , , , , ,