Question: This looks weird, I have an apache httpd server in a CentOS box, which has this security problem:

Virtual hosts are enabled, the site is in /data/www/vhost2/index.php
It looks like that if I tell index.php to look for a file in ../../ (so it exits the www directory) it SEES IT! How can I block php from looking outside this directory? Do I have to use basedir? What about virtualhosts, is it possible to do it for every folder in a sandbox-like way?

Thanks

Answer: 
Hackers generally bypass open\_basedir using symlinks. My server was hacked several times using this. The best way is to install Suhosin and disable potentially dangerous functions like symlink. Below is the link of installation tutorial probably old but may work

<http://www.webhostgear.com/416.html>

then block following functions using below directive in php.ini

```
suhosin.executor.func.blacklist = "show_source,shell_exec,passthru,exec,popen,system,system, shell_exec, passthru, exec, popen, proc_open, symlink, php_uname,etmyuid,passthru,leak,listen,diskfreespace,link,ignore_user_abord,shell_exec,dl,exec,highlight_file,source,show_source,fpaththru,virtual,posix_ctermid,posix_getcwd,symlink,popen,system,escapeshellarg,escapeshellcmd,myshellexec,c99_buff_prepare,c99_sess_put,posix_getegid,posix_geteuid,posix_getgid,posix_getgrgid,posix_getgrnam,posix_getgroups,posix_getlogin,posix_getpgid,posix_getpgrp,posix_getpid,posix,getppid,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_getsid,posix_getuid,posix_isatty,posix_kill,posix_mkfifo,posix_setegid,posix_seteuid,posix_setgid,posix_setpgid,posix_setsid,posix_setuid,posix_times,posix_ttyname,posix_uname,proc_open,proc_close,proc_get_status,proc_nice,proc_terminate"

```
This is normal behavior for unconfigured and unhardened system, you can symply set `open_basedir` option in `php.ini` to define limit (<http://www.php.net/manual/en/ini.core.php#ini.open-basedir>).

But it won't limit shell scripts and `exec` commands run from php script from accessing these files, you may disable some of these functions with `disable_functions`.

Generally, there are many things regarding hardening and it's not that easy to list them in here, and it's architectural. For example, currently, I guess, you are running apache prefork MPM with mod\_php, in case of mod\_fcgid + php-cgi - you won't be able to work with `/data` at all, because it's limited by mod\_fcgid to the `/var/www/`, also, there is selinux limitation by default `targeted` policy etc.

You will find more and more issues like this.