Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

So I'm setting up a shared hosting with Apache, PHP, MySQL and the biggest question mark is how to do with PHP, since there is a million options out there how to configure it securely.

The plan is:

  • Chroot for MySQL (built in support for chroot)
  • Chroot for Apache (mod_security)
  • Each user executing their PHP-scripts as their own user (see below)
  • Set open_basedir
  • Disable all "evil" php-functions (allow_url_fopen, system, exec, and so on)

Ive looked at suexec and suphp but they seems very slow;

http://blog.stuartherbert.com/php/2007/12/18/using-suexec-to-secure-a-shared-server/ http://blog.stuartherbert.com/php/2008/01/18/using-suphp-to-secure-a-shared-server/

So I've looked some more and found some other solutions:

  • apache2-mpm-itk + mod_php(?)
  • mod_fcgid + php-fpm
  • mod_fastcgi + php-fpm

Ive tried a simple setup with mod_fastcgi + php-fpm and it seems to work, runs as correct user and so on, but the protection against directory traveling is still open_basedir(?)

One solution for that could be to use php-fpm's chroot option, but that causes a lot of other issues like

  • domain name resolver does not work
  • sending mail does not work

Tips?

share|improve this question

2 Answers 2

The fpm project did a great job allowing the deploy of shared hosting solutions quite easily, even chrooting the users (however, there are some problems with apache that could be solved through symlinking; there are a lot of tutorials on the internet about it).

The solution involving php5-fpm requires mod_fastcgi and allows the hoster to make per-user configurations (memory_limit, max_execution_time... just as an example), and from what I've been able to see, it's pretty stable ;)
About the problems with resolving and using the emails, they're easily solved adding the libraries to the chrooted environment and the executables needed (sendmail for example).

The problem I've found and I'm solving, is about the wrong variables passed to the php scripts by the php-fpm (after chrooting, php-fpm should remove the outside directories, passing to the script only the ones inside the chroot... but it doesn't and something else must take care of that, something like a proxy between mod_fastcgi and php-fpm).
I've managed to solve the problem using a fcgi proxy between php-fpm and apache that automatically corrects the variables, since php-fpm at the time I am writing doesn't manage to fix them.

share|improve this answer
    
I second this; use php-fpm; it allows for user isolation and control. –  josten Nov 13 '13 at 3:07

Since when this question was asked and responded to, CloudLinux has really become a mainstream Linux distro in the shared hosting space. It's based on RHEL/CentOS as its upstream though with some modifications. Here are some details:

  • It provides something called CageFS to handle chrooting.
  • For running PHP it offers something called mod_lsapi which is a way to run PHP with good performance in a very similar way to what you'd be used to with mod_php (i.e. able to use php_flag and php_value in .htaccess files and it does opcode caching in a good way). It's able to do this with good privilege isolation between users.
  • It also provides a kernel-level modification to protect against symlink attacks.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.