multiuser PHP virtualhosting environment and security

Question

I'd like to setup a multiuser PHP virtualhosting environment.

However, here comes my big concern. Users could use the PHP filesystem functions to access the other users directories, thus read the source files and gaining inmediate access to databases passwords and other kind of sensitive data.

I've been looking at lots of resources in order to address this issue. However, none of them seems satisfactory to me.

Is there any way to run PHP in a setuid environment for each of the VirtualHosts defined by Apache? Has anyone already gone through this setup which can guide me on the steps required for doing so? How are the big hosting companies doing it?

Thanks, Corin

Answer 1

Setuid environments do work pretty well. If you are using CPanel, you can set this up pretty easily through easyapache. If you aren't, you have to set it up manually. suPHP is an excellent start here.

As to why you should bother, it's about layered security. There have been several PHP exploits that allow you to evade open_basedir restrictions. If that's your only protection, then it's possible someone could get around that. If you use open_basedir and suPHP (with correct permissions), you would be protecting your clients against exploits within open_basedir.

suPHP also makes finding the source of abuse much easier. With just open_basedir, you can't tell what process is owned by what user. If some user were to upload a script that started consuming all the CPU, it would take some serious digging to determine which one. With suPHP, all you need to do is use 'top', to see both the abusive user, and the full path to the script.

Answer 2

Is there any way to run PHP in a setuid environment for each of the VirtualHosts defined by Apache?

This is not the way to solve the problem. Apache runs as a single uid. There are systems like suPHP, but why bother when you can use the standard packages and set open_basedir which explicitly solves the problem you describe.

Do think about how you can allow users to manage their own sites securely - relying on ownership of files determine permissions means you effectively restrict the ability of users to manage file security themselves. They should be able to manipulate files/dirs (by default) in such a way that they are not writeable by the webserver uid, while optionally providing a mechanism to handle uploads (preferably outside the document root).