Disable_functions - What should i block? feedback required

[shoulders]

Hi all

I will be running WordPress and Joomla websites on my Virtualmin server.

I don’t want client virtual servers being able to run anything they shouldn’t or if the accounts become compromised do nasty things on my server, so part of this is to have a well defined disable_functions in your php.ini

The following is mine. Can anyone see anything missing or functions that should not blocked?

disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,system,passthru,popen,exec,proc_close,proc_get_status,proc_nice,proc_open,proc_terminate,highlight_file,escapeshellcmd,define_syslog_variables,posix_uname,posix_getpwuid,apache_child_terminate,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,escapeshellarg,posix_uname,ftp_exec,ftp_connect,ftp_login,ftp_get,ftp_put,ftp_nb_fput,ftp_raw,ftp_rawlist,ini_alter,ini_restore,inject_code,syslog,openlog,define_syslog_variables,apache_setenv,mysql_pconnect,eval,phpAds_XmlRpc,phpAds_remoteInfo,phpAds_xmlrpcEncode,phpAds_xmlrpcDecode,xmlrpc_entity_decode,fp,fput,shell_exec,apache_get_modulesi,

NB: mail can be added to prevent the use of mail()

Thanks for any feedback

[verne]

a general comment – I really love the way Virtualmin isolates each virtual server from all the others – having all the files under the /home/ directory as well as having those files owned by the Linux virtual server admin user. I believe this gives a lot of additional security by not allowing any admin account to see any other accounts on the system. And with PHP-FPM running as the admin user, you also have that same isolation.

At least I hope that’s the way things work – I have been advocating Virtualmin to my co-workers for several years because of this (and many other useful features and design considerations) in Virtualmin