Announcement Announcement Module
Collapse
No announcement yet.
disable_functions in php.ini Page Title Module
Move Remove Collapse
X
Conversation Detail Module
Collapse
  • Filter
  • Time
  • Show
Clear All
new posts

  • disable_functions in php.ini

    It is safe and secure to disable certain php functions in linux servers.

    PHP has a lot of functions which can be used to crack your server if they are not used properly.
    You can set list of functions in php.ini using disable_functions directive. This directive allows you to disable certain functions for security reasons. It takes on a comma-delimited list of function names. disable_functions is not affected by Safe Mode. This directive must be set in php.ini file.

    Note: you cannot set this in httpd.conf file.


    Open a terminal/console or login to your server using the ssh session. Then open the php.ini file using any of the editors like vim, vi, pico. nano etc..
    # vi /etc/php.ini

    The php.ini file location won't be same for all server, if you couldn't fine the php.ini file in the above mentioned location, you can use the below command to find the PHP Loaded Configuration File;

    php -i | grep php.ini

    There you can find the directive 'disable_functions' in php.ini file

    disable_functions= exec,passthru,shell_exec,system,proc_open,popen,cu rl_exec,curl_multi_exec,parse_ini_file,show_source

    I also recommend to disable allow_url_include and allow_url_fopen if they are not in use exactly.

    allow_url_fopen=Off
    allow_url_include=Off

    Now its the time to restart the HTTP service.

    # service httpd restart
Working...
X