Currently I am running nginx 1.0.11 and PHP-FPM. Each site has it's own user/group and has their home directory in
/srv/www/.... I have the PHP-FPM pools set to run as the sites' user and group on separate ports (9001 for site1, 9002 for site2...). Does this do anything to help with security?
nginx is running as www-data:www-data. Currently if I have a PHP script in site1
(/srv/www/site1.com/www/public_html/script.php)I can do this
include $_SERVER['DOCUMENT_ROOT'] . "/../../../site2.com/www/public_html/index.html"; and read that site's files.
How can I prevent this? I looked into
chroot but each site's home directory has symlinks to
/dotfiles that I need to keep and I assume nginx will need to access logs at