Timeline for Is it a security issue when PHP runs as root in a shared hosting environment?
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 3, 2016 at 23:05 | comment | added | Jenn | @Andrew thanks for the input, as U say a lot depends on how the server is setup, which is of course provider dependent. WHM has a lot of options and cPanel (the company) have lengthy docs on security. One of my clients is with a particular provider (I am trying to convince them to change providers) that does not even use https for cpanel access !!!! when challenged about that they said in 6 years they had not had an issue - it is not a matter of if they get compromised but merely a matter of when! That is the sort of thing one sometimes has to put up with :( | |
| Feb 3, 2016 at 16:42 | comment | added | closetnoc | It sounds like you are more a an expert on this than most! Also consider that PHP is an environment based language like Java and others. This allows the script to be isolated and not have direct access to the machine. How that manifests specifically for PHP, I am not entirely sure. However, traditionally, this model can be made relatively stable and secure over time. It seems that PHP is relatively stable and secure today. However, I have hobbled PHP and Java so that Apache websites cannot access these languages and environments at all while Apache still can. Just in case. | |
| Feb 3, 2016 at 11:58 | comment | added | Andrew Lott | I may not be a "server guru" per se, but hopefully that still answers the question. | |
| Feb 3, 2016 at 11:57 | history | answered | Andrew Lott | CC BY-SA 3.0 |