Spooky Wordpress plugin Wordfence scan telling whole disk space

whnewbie

• August 04, 2014 11:35

My setup is cPanel / WHM 11.44 (latest), CloudLinux 6 (latest), Apache 2.4, Native PHP 5.4 (latest in EasyApache), CageFS and PHP Selector (CloudLinux) Just installed a Wordpress site and tried out a security plugin "Wordfence". During its "scan", I found that Wordfence could find out the disk space of the server and disk spaced used (and hence free disk space). This is rather spooky. I wonder how they manage to do this and wonder if this affects security of the server. Any way to prevent this is nice as I prefer more "privacy". Thanks.

• 

  quizknows

  • August 04, 2014 20:31

  Most standard system binaries like /bin/df are 755 permissions, so most users (including the usernames which execute apache and PHP) can run them. This is pretty normal. You could try restricting some of the more risky php functions by using the disable_functions setting in /usr/local/lib/php.ini. This can make it harder for php scripts to use system utilities. Mine is currently set to this: disable_functions = show_source,system,shell_exec,passthru,exec,phpinfo,popen,proc_open,allow_url_fopen Keep in mind this does not take into account that on most systems users can just set their own php.ini settings anyway, but there are other threads about stopping that ability.

  0
• 

  cPanelMichael

  • August 05, 2014 12:43

  Hello :) To note, one of the threads referenced in the previous post is: Methods to Increase Security on suPHP - Restricting who can use php.ini files Thank you.

  0

Please sign in to leave a comment.