Disable_functions

[jimdunn]

Someone mentioned having a “comprehensive disable_functions set”…

I wanted to know if anyone would care to share their disable_functions= with us??

[Armmiss]

For my servers, I’m currently using the following disable_functions list:

disable_functions = exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname

So far, I haven’t encountered any compatibility issues with the applications I host.

I also shared some additional PHP and server hardening recommendations in this thread, in case it’s useful to anyone:

Hardening questions

SYSTEM INFORMATION OS type and version RHEL 10 Webmin version latest Virtualmin version latest Webserver version Apache latest Related packages SUGGESTED Hello everyone, I’m new to Virtualmin after spending more than 10 years using DirectAdmin. I decided to move to Virtualmin because I wanted a solution that is more open source and gives me more flexibility. I’m currently deploying a new server on RHEL 10 and I’d like to harden the system configuration before putting it int…

I’m always interested in comparing configurations, so if anyone has suggestions or sees something worth adding or removing, I’d be happy to hear them.

[shoulders]

I will add mine here tommorow

[shoulders]

here you go.

Don’t use the Webmin GUI. Just paste straight into the php.ini

disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,system,passthru,popen,exec,proc_close,proc_get_status,proc_nice,proc_open,proc_terminate,highlight_file,escapeshellcmd,define_syslog_variables,posix_uname,posix_getpwuid,apache_child_terminate,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,escapeshellarg,posix_uname,ftp_exec,ftp_connect,ftp_login,ftp_get,ftp_put,ftp_nb_fput,ftp_raw,ftp_rawlist,ini_alter,ini_restore,inject_code,syslog,openlog,define_syslog_variables,apache_setenv,mysql_pconnect,eval,phpAds_XmlRpc,phpAds_remoteInfo,phpAds_xmlrpcEncode,phpAds_xmlrpcDecode,xmlrpc_entity_decode,fp,fput,shell_exec,apache_get_modulesi,