Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So I'm setting up a shared hosting with Apache, PHP, MySQL and the biggest question mark is how to do with PHP, since there is a million options out there how to configure it securely.

The plan is:

  • Chroot for MySQL (built in support for chroot)
  • Chroot for Apache (mod_security)
  • Each user executing their PHP-scripts as their own user (see below)
  • Set open_basedir
  • Disable all "evil" php-functions (allow_url_fopen, system, exec, and so on)

Ive looked at suexec and suphp but they seems very slow;

http://blog.stuartherbert.com/php/2007/12/18/using-suexec-to-secure-a-shared-server/ http://blog.stuartherbert.com/php/2008/01/18/using-suphp-to-secure-a-shared-server/

So I've looked some more and found some other solutions:

  • apache2-mpm-itk + mod_php(?)
  • mod_fcgid + php-fpm
  • mod_fastcgi + php-fpm

Ive tried a simple setup with mod_fastcgi + php-fpm and it seems to work, runs as correct user and so on, but the protection against directory traveling is still open_basedir(?)

One solution for that could be to use php-fpm's chroot option, but that causes a lot of other issues like

  • domain name resolver does not work
  • sending mail does not work

Tips?

share|improve this question

1 Answer 1

The fpm project did a great job allowing the deploy of shared hosting solutions quite easily, even chrooting the users (however, there are some problems with apache that could be solved through symlinking; there are a lot of tutorials on the internet about it).

The solution involving php5-fpm requires mod_fastcgi and allows the hoster to make per-user configurations (memory_limit, max_execution_time... just as an example), and from what I've been able to see, it's pretty stable ;)
About the problems with resolving and using the emails, they're easily solved adding the libraries to the chrooted environment and the executables needed (sendmail for example).

The problem I've found and I'm solving, is about the wrong variables passed to the php scripts by the php-fpm (after chrooting, php-fpm should remove the outside directories, passing to the script only the ones inside the chroot... but it doesn't and something else must take care of that, something like a proxy between mod_fastcgi and php-fpm).
I've managed to solve the problem using a fcgi proxy between php-fpm and apache that automatically corrects the variables, since php-fpm at the time I am writing doesn't manage to fix them.

share|improve this answer
    
I second this; use php-fpm; it allows for user isolation and control. –  josten Nov 13 '13 at 3:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.