Setup secure shared hosting (Apache, PHP, MySQL)

Question

So I'm setting up a shared hosting with Apache, PHP, MySQL and the biggest question mark is how to do with PHP, since there is a million options out there how to configure it securely.

The plan is:

• Chroot for MySQL (built in support for chroot)
• Chroot for Apache (mod_security)
• Each user executing their PHP-scripts as their own user (see below)
• Set open_basedir
• Disable all "evil" php-functions (allow_url_fopen, system, exec, and so on)

Ive looked at suexec and suphp but they seems very slow;

http://blog.stuartherbert.com/php/2007/12/18/using-suexec-to-secure-a-shared-server/ http://blog.stuartherbert.com/php/2008/01/18/using-suphp-to-secure-a-shared-server/

So I've looked some more and found some other solutions:

• apache2-mpm-itk + mod_php(?)
• mod_fcgid + php-fpm
• mod_fastcgi + php-fpm

Ive tried a simple setup with mod_fastcgi + php-fpm and it seems to work, runs as correct user and so on, but the protection against directory traveling is still open_basedir(?)

One solution for that could be to use php-fpm's chroot option, but that causes a lot of other issues like

• domain name resolver does not work
• sending mail does not work

Tips?

Answer 1

The fpm project did a great job allowing the deploy of shared hosting solutions quite easily, even chrooting the users (however, there are some problems with apache that could be solved through symlinking; there are a lot of tutorials on the internet about it).

The solution involving php5-fpm requires mod_fastcgi and allows the hoster to make per-user configurations (memory_limit, max_execution_time... just as an example), and from what I've been able to see, it's pretty stable ;)
About the problems with resolving and using the emails, they're easily solved adding the libraries to the chrooted environment and the executables needed (sendmail for example).

The problem I've found and I'm solving, is about the wrong variables passed to the php scripts by the php-fpm (after chrooting, php-fpm should remove the outside directories, passing to the script only the ones inside the chroot... but it doesn't and something else must take care of that, something like a proxy between mod_fastcgi and php-fpm).
I've managed to solve the problem using a fcgi proxy between php-fpm and apache that automatically corrects the variables, since php-fpm at the time I am writing doesn't manage to fix them.

Answer 2

Since when this question was asked and responded to, CloudLinux has really become a mainstream Linux distro in the shared hosting space. It's based on RHEL/CentOS as its upstream though with some modifications. Here are some details:

• It provides something called CageFS to handle chrooting.
• For running PHP it offers something called mod_lsapi which is a way to run PHP with good performance in a very similar way to what you'd be used to with mod_php (i.e. able to use php_flag and php_value in .htaccess files and it does opcode caching in a good way). It's able to do this with good privilege isolation between users.
• It also provides a kernel-level modification to protect against symlink attacks.