3

Because Joomla uses so much third party components and such, what are some safe functions and classes to add to the php.ini for disabled_classes and disabled_functions?

The reason I ask this is for locking down a server more, adding more to those php.ini properties is best.

exec() is obvious however ones like base64_decode() are not since they are used often, are there any other functions that are safe and worthwhile? (not counting the defaults php uses).

NOTE: This is not meants as a "cure all" for security, just one part of security.

Improve this question
1

These are some common ones that folks recommend disabling:

show_source, system, shell_exec, passthru, exec, popen, proc_open,

Especially in Joomla environments without any problems. It's really more of a use-case thing when it comes to some functions, but ideally you don't want to leave on any of the especially shaky ones if you're not using them. I also recommend disabling HTTP methods that aren't being used arbitrarily or systematically like DELETE or TRACE.

Improve this answer
1

If you are relying on the php.ini settings for disabling core functions to give you more "security" then you have already failed.

Server security is about more than disabling functions. Infact a very secure server doesnt need any PHP Functions disabled in the way you refer to.

Furthermore if you implement per user php.ini (.user.ini) files to disable these functions then all a hacker has to do is remove those to gain access to functions you thought were secure and blocked!

Even though the "official" checklist says to disable functions, do not believe everything you read on this subject!

Improve this answer
5
  • Main thing of this is that for one, yes we have already failed :P, our server has been compromised due to Joomla vulnerabilities, so we just want to do anything and everything to lock it down. The questions is based on something that could perhaps help others. I generalized the question as it is more Joomla specific to know what functions or classes should not normally be used by extension, but would be by hacks. php.ini is one part of a huge checklist, so this is one in many things to look for when securing a server. – Jordan Ramstad Apr 29 '14 at 20:47
  • 1
    No you were not hacked because of Joomla Vulnerabilities. You were hacked because you did not update Joomla when new releases were made. I'm fed up with people blaming "Joomla Vulnerabilities" when infact they should be blaming themselves for not taking basic responsibility! You should not disable ANY PHP Core functions. Period. – user239 Apr 30 '14 at 0:04
  • We host a shared server structure, so its actually impossible for us to update Joomla for everyone on a regular basis. You do make a fair point for a single Joomla site, but given we have so many we can only look for solutions on the server level. I did not mean to blame it on "Joomla Vulnerabilities" but it is a fact that although patched in newer versions, they do exist. There is also some sites that have extensions or core modifications that prevent a Joomla update, for those people this sort of question would help them greatly. – Jordan Ramstad May 7 '14 at 18:52
  • I disagree. It is perfectly possible to update Joomla for everyone on a regular basis, and your hosting model should extend to providing that - at a fee - for your customers. There simply is no excuse for running vulnerable Joomla versions – user239 Dec 1 '15 at 12:31
  • Your welcome to your opinion, our solution ended up being to use site ground with their site jail software, so server level fix. We do as you say and update frequently but its just not enough. If we charge our customers for it we have to make sure to mitigate the problems in any way we can. – Jordan Ramstad Dec 3 '15 at 20:11
0

A good practice is to have a system user exclusive to run your joomla. Thus you can restrict this user to access only the joomla folder.

I think you must avoid to disable these functions because some extension can need them for good and not for evil.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.