The Register is running a story today TinyURL, your configs are showing which points out that TinyURL has a /php.php page displaying the contents of phpinfo().
The article then goes on to make some scary sounding claims from security consultant Rafal Los “Why would you want to run a web service as ‘Administrator’ because if
I figure out a way to jack that service, I completely, 100% own that
machine.” and “More importantly… why is this server running as ROOT:WHEEL?!“
Sorry Rafal – but you appear to have no idea how web servers work, or all that much about (web) security.
All unix based webservers start as root if they want to bind to the restricted (and default) port 80, after which they switch to the configured UID for request handling. So, right there, goes all Rafal’s claims about pwning the machine.
Check your own server, the _SERVER and _ENV values will reflect the
starting shell/environment, which just happens to be root. In
other words, there is nothing wrong with the settings. Having said that, they do have register_globals turned on, which isn’t ideal – but it isn’t a gaping hole if the underlying php code is safely coded.
Also to TinyURL’s credit, they are running Suhosin patch to harden their server. They’re also running the latest production PHP (which is more than I can say). Granted, they probably don’t want to be exposing phpinfo() – but this all just an overblown storm in a teacup.