From owner-freebsd-isp@FreeBSD.ORG Tue Jul 26 05:11:44 2005 Return-Path: X-Original-To: freebsd-isp@freebsd.org Delivered-To: freebsd-isp@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9454016A41F for ; Tue, 26 Jul 2005 05:11:44 +0000 (GMT) (envelope-from nospam@mgedv.net) Received: from mgedv.at (www.mgedv.at [195.3.87.103]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3A82C43D45 for ; Tue, 26 Jul 2005 05:11:43 +0000 (GMT) (envelope-from nospam@mgedv.net) Received: from metis (localhost [127.0.0.1]) by mgedv.at (SMTPServer) with ESMTP id 724D5186800 for ; Tue, 26 Jul 2005 07:11:41 +0200 (MEST) From: "mdff" To: Date: Tue, 26 Jul 2005 07:11:45 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.6353 In-Reply-To: <42E54654.1090705@chef-ingenieur.de> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527 thread-index: AcWRVF37+V3rMGCwSJmYqAJmStEb2QATB0rQ Message-Id: <20050726051141.724D5186800@mgedv.at> Subject: RE: preventing a user to start a process X-BeenThere: freebsd-isp@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: nospam@mgedv.net List-Id: Internet Services Providers List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Jul 2005 05:11:44 -0000 > > Hello, > is it possible to bar a user (www) from starting a process? > I've a irc daemon running under the uid www. I think > this was done by php. What would be the best way to prevent > this (php should be remain usable)? I've installed ipfw rules, > but this doesn't prevent the starting of the process. > jail the whole stuff and put only commands in there, that are required. also, remove write permissions almost everywhere, except where they are absolutely needed. mount a mfs for example with noexec to allow the webserver saving temp-files w/o executing stuff from there. and use php-safe-mode as mentioned before ;-) br