The interface looks very nice but no thanks, I'm not going to install PHP on my servers to have it. I'd totally set it up if it weren't for PHP. The risk is just too great to ignore.
Show HN: Linux server monitoring web dashboard
31–40 of 70 posts
Re: Show HN: Linux server monitoring web dashboard
#32The interface looks very nice but no thanks, I'm not going to install PHP on my servers to have it. I'd totally set it up if it weren't for PHP. The risk is just too great to ignore.
Some server side code is required to obtain the data. Out of curiosity, what would it have to be written in to make you feel safe?
Re: Show HN: Linux server monitoring web dashboard
#33The interface looks very nice but no thanks, I'm not going to install PHP on my servers to have it. I'd totally set it up if it weren't for PHP. The risk is just too great to ignore.
Have you even looked at the (trivial amount) of PHP source code? Where is PHP going to be attacked? Perhaps I am missing something obvious but it seems like PHP is running some linux commands and parsing the results, not sure how this would be different/safer in another language?
Also you can put it behind http auth or restrict the vhost by IP etc
Re: Show HN: Linux server monitoring web dashboard
#34The interface looks very nice but no thanks, I'm not going to install PHP on my servers to have it. I'd totally set it up if it weren't for PHP. The risk is just too great to ignore.
I had the same attitude, so I forked it and rewrote the PHP endpoints as a Python script, which I execute outside of the context of the application via a cronjob.
Re: Show HN: Linux server monitoring web dashboard
#35The interface looks very nice but no thanks, I'm not going to install PHP on my servers to have it. I'd totally set it up if it weren't for PHP. The risk is just too great to ignore.
Have you even looked at the (trivial amount) of PHP source code? Where is PHP going to be attacked? Perhaps I am missing something obvious but it seems like PHP is running some linux commands and parsing the results, not sure how this would be different/safer in another language? Also you can put it behind http auth or restrict the vhost by IP etc
It's not how much PHP is running, it's that PHP is running _at all_. It makes me feel very, very uneasy that every time that web interface is hit PHP executes a shell command. There's something inherently wrong about that, to me.
Re: Show HN: Linux server monitoring web dashboard
#36Earlier quoted context omitted.
Have you even looked at the (trivial amount) of PHP source code? Where is PHP going to be attacked? Perhaps I am missing something obvious but it seems like PHP is running some linux commands and parsing the results, not sure how this would be different/safer in another language? Also you can put it behind http auth or restrict the vhost by IP etc
It's not how much PHP is running, it's that PHP is running _at all_. It makes me feel very, very uneasy that every time that web interface is hit PHP executes a shell command. There's something inherently wrong about that, to me.
Unless the script accepts parameters, which it doesn't, there's nothing to worry about.
Re: Show HN: Linux server monitoring web dashboard
#37The interface looks very nice but no thanks, I'm not going to install PHP on my servers to have it. I'd totally set it up if it weren't for PHP. The risk is just too great to ignore.
Some server side code is required to obtain the data. Out of curiosity, what would it have to be written in to make you feel safe?
In anything that is not PHP. Bash would have been perfect for this use case, for example. The correct way to do this is to obtain the data separately and merely show it on the interface. I haven't audited the code, so I don't know what's being passed to the shell commands, but the fact that an attacker MIGHT be able to influence the commands being executed (see register_globals, etc (yes, I know this has been disabled by default in recent versions of PHP)) is enough for me to completely write it off as an unnecesary risk.
By collecting the data periodically (i.e a cron job) you eliminate most possible vulnerabilities.
Re: Show HN: Linux server monitoring web dashboard
#38The interface looks very nice but no thanks, I'm not going to install PHP on my servers to have it. I'd totally set it up if it weren't for PHP. The risk is just too great to ignore.
"The risk is just too great to ignore."
Can you elaborate on this? I'm looking for you to clarify which other dynamic languages would be considered less risky in this specific application and why.
Re: Show HN: Linux server monitoring web dashboard
#39Earlier quoted context omitted.
It's not how much PHP is running, it's that PHP is running _at all_. It makes me feel very, very uneasy that every time that web interface is hit PHP executes a shell command. There's something inherently wrong about that, to me.
Unless the script accepts parameters, which it doesn't, there's nothing to worry about.
Like I said in a previous reply, see register_globals and company. Sure, that was some time ago. Sure, the defaults are better now. But at some point in time the people in charge of PHP thought "yes, this is a good idea, let's do it".
...
It's not like the attitude has changed, though. There are many, many things deeply wrong with PHP when it comes to security. PHP is supposed to cater to unexperienced programmers. An unexperienced programmer might see "mysql_escape_string" and think that it will escape strings, making them suitable for use in SQL queries. The programmer will think the code is secure. WRONG. Because you have to use mysql_REAL_escape_string.
Also, look at the `e` flag in preg_replace. WHAT THE FUCK. Like, seriously. What. Why. There are no words to describe how gobsmacked I am.
And FOUR people in the PHP committee (or whatever it's called) voted __AGAINST__ deprecating it. FOUR. [1]
--
The point is that I can't audit (and would rather not waste my time doing so) this PHP code. The fact that it uses shell_execute when a HTTP request demands it is enough of a red flag.
[1] https://wiki.php.net/rfc/remove_preg_replace_eval_modifier
Re: Show HN: Linux server monitoring web dashboard
#40you sure you don't want to make a go at turning this into a full blown product? Imagine a more modern version of webmin. Very nice.
Webmin still works and is actively maintained. There even are good-looking themes nowadays. It would be a huge endeavour to re-implement all that came into webmin in the past ten years.
But Webmin not satisfies the NIH-Syndrom ;-)