On most web servers, PHP normally executes as the user "nobody" and is ran as an Apache module. The ability to execute arbitrary code as an unprivileged user may lead to modified web content, denial of service, or further compromise. With that said, why does an unsafe configuration still reign as default for many web hosts? Perhaps it has just been the quick and dirty way to get a server up and running. This setup also leaves something to be desired in file and permission structure.Since there was never an official Web Hosting Manual, the quick way has been the only way far too long. The bad guys have now had more than enough time to romp around the stateless protocol. They are all knowing of the fact that thousands upon thousands of servers are humming along in this disorganized state, fully welcoming of their trespasses. But running hundreds of nameless processes seems silly, doesn't it? Why would a person responsible for a piece of the Internet even think allowing anonymous activity made sense? And if we usually want things the fast and easy way, how can we expect something this tangled to be managed properly? It's especially peculiar when you consider the learning curve faced by reseller account holders turned server managers. Even though I have painted a dark scene, this setup is not such a bad thing on a server which houses only a few accounts. On the other hand, a web hosting company with thousands of customers dotted across a server farm will absolutely need a different approach for keeping track of user activity.PHP can really exist in pseudo server harmony even though it is the most major source of problems for many hosts. Just one change is a great start to regaining control of your network. Just take a look at how PHP is running on your server: PHP running as "nobody" is not the way to go. Since web-based PHP applications spell doom, all processes need to be attached to the usernames of your customers. An easy way to fix that is to run PHPsuexec. Once you do this you can also completely disallow emailing from old-style scripts which send messages via nobody (such as dated contact forms and guestbooks). "PHPsuexec is the shortened term often used to describe running PHP as a CGI [module] with suexec. Running PHP as a CGI with suexec creates a much more secure environment compared to running PHP as an Apache module." A quick Google search revealed this fairly thorough article on phpsuexec which you can find here. If you have any qualms or critiques on how nobody can become somebody, please let me know! More About Kayla
