Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Ok once I installed piwik on a server I get the following errors:

  • user_id - PHP may be executing as a "privileged" user, which could be a serious security vulnerability.

  • group_id - PHP may be executing as a "privileged" group, which could be a serious security vulnerability.

I currently have it set up as

User apache
Group apache

and in my passwd file I have

apache:x:48:48:Apache:/var/www:/sbin/nologin

Any ideas on how to clear up these errors?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

You could configure suPHP. This will execute PHP scripts with the permissions of the file owner.

In your current configuration, all PHP code will be executed with the permissions of the apache user. In a shared hosting environment, this isn't a Good Thing. If it's not a shared environment, you probably don't need to worry too much.

As an example:

Let's say you have 2 users, bob and tom with websites configured on your sever. Their document roots sit at

/home/bob/public_html
/home/tom/public_html

Bob wants to add an uploads folder to his site so he can upload stuff. So he sets up

/home/bob/public_html/uploads

This folder must be writable by apache

Well, now you have a situation where tom can write to bob's uploads folder as scripts in both their sites are being executed as apache which has write access to bob's uploads folder. He needs to know the path, but that's not necessarily a difficulat thing to figure out.

Once you configure suPHP, the script in tom's site is run as tom, so he can't write to bob's uploads folder, unless bob wants him too.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.