Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a dedicated server, on this server i have two vhosts. and i will give the access of the server to two people. In my php file there's the database password and i don't want to share that with them. So how can i protect the php file from reading? If i do a chmod 700 apache2 can not read and the page is "Forbidden". Thanks and good night

share|improve this question
    
What hardware and OS is your server? Could you run to 2 VM each with its own IP and apache? –  ott-- Nov 1 '11 at 1:42
    
Debian Lenny on a thinkpad T43. No, there are host on the same ip adress –  Gordon Nov 1 '11 at 1:45
    
Which user is Apache running as? Take a look at the error log when you get "403 forbidden". –  quanta Nov 1 '11 at 2:57
add comment

2 Answers

In order to use the data, it must be readable by the webserver uid - which means that anyone whom can deploy PHP code on the server can read the files. This is true of all web programming languages.

PHP is unusual in that it does provide mechanisms for partitioning shared access on a webserver

  1. by use of the open_basedir directive - you just need to configure different directory trees according to access - and set up seperate database accounts with the relevant credentials stored in the separate environments - and configure the security at the database tier.

  2. Alternatively you can use suPHP to restrict access based on a virtual user - when a PHP script runs, it does so with the uid/gid of the PHP script. Again you need separate database accounts with different privileges to control data access.

share|improve this answer
1  
Word of warning: open_basedir has historically been anything but waterproof. Functions such as Curl or IMAP functions do not necessarily obey open_basedir restrictions and will bypass them happily. It's a nice bit of security but at least in the past it was easy to get around. –  Janne Pikkarainen Nov 1 '11 at 10:34
    
I thought the imap vuln only allowed file mods - not reading from files? OTOH, I thought the curl thing was fixed a long time ago - but I see there is a recent variant exploit - securityreason.com/achievement_securityalert/61 –  symcbean Nov 1 '11 at 11:16
    
At one point it was possible to read any file accessible for the user running the PHP script with imap_open(), imap_body() and imap_list(). Granted, this was many years ago, but still a good warning about the weaknesses in open_basedir. Considering the vast amounts of PHP modules and functions there are, the chances are many of them are still vulnerable even though things have gotten lots better. –  Janne Pikkarainen Nov 1 '11 at 11:27
add comment

If you've got root access, then you can setup permissions on the file so that apache (and thus php) can read it using a supplementary group; and prevent the two "users" from reading it.

Without knowing about your OS variant; something like the following process should work. Testing is of course mandatory.

# create new group 
groupadd credentials
# add apache to that group (supplementary group)
usermod -G credentials -a apache
# change file ownership
chgrp credentials /etc/credentialfile.conf
chown root /etc/credentialfile.conf
chmod 640 /etc/credentialfile.conf

You will need to restart Apache to acquire the new supplementary groups.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.