PHP MySQL - Stilson.net

CHAPTER 21 • SECURING YOUR WEB SITEwww.it-ebooks.infoThis directive specifies the name of the directory in a user’s home directory where PHP scripts mustbe placed in order to be executed. For example, if user_dir is set to scripts and user Johnny wants toexecute somescript.php, Johnny must create a directory named scripts in his home directory and placesomescript.php in it. This script can then be accessed via the URL http://example.com/~johnny/scripts/somescript.php. This directive is typically used in conjunction with Apache’s UserDirconfiguration directive.Hiding Configuration DetailsMany programmers prefer to wear their decision to deploy open source software as a badge for theworld to see. However, it’s important to realize that every piece of information you release about yourproject may provide an attacker with vital clues that can ultimately be used to penetrate your server.Consider an alternative approach of letting your application stand on its own merits while keeping quietabout the technical details whenever possible. Although obfuscation is only a part of the total securitypicture, it’s nonetheless a strategy that should always be kept in mind.Hiding ApacheApache outputs a server signature included within all document requests and within server-generateddocuments (e.g., a 500 Internal Server Error document). Two configuration directives are responsible forcontrolling this signature: ServerSignature and ServerTokens.Apache’s ServerSignature DirectiveThe ServerSignature directive is responsible for the insertion of that single line of output pertaining toApache’s server version, server name (set via the ServerName directive), port, and compiled-in modules.When enabled and working in conjunction with the ServerTokens directive (introduced next), it’scapable of displaying output like this:Apache/2.2.12 (Ubuntu) Server at localhost Port 80Chances are you would rather keep such information to yourself. Therefore, consider disabling thisdirective by setting it to Off.This directive is moot if ServerSignature is disabled. If for some reason ServerSignature must beenabled, consider setting the directive to Prod.Apache’s ServerTokens DirectiveThe ServerTokens directive determines which degree of server details is provided if the ServerSignaturedirective is enabled. Six options are available: Full, Major, Minimal, Minor, OS, and Prod. An example ofeach is given in Table 21-1.430