Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Currently I am running nginx 1.0.11 and PHP-FPM. Each site has it's own user/group and has their home directory in /srv/www/.... I have the PHP-FPM pools set to run as the sites' user and group on separate ports (9001 for site1, 9002 for site2...). Does this do anything to help with security?

nginx is running as www-data:www-data. Currently if I have a PHP script in site1 (/srv/www/site1.com/www/public_html/script.php)I can do this include $_SERVER['DOCUMENT_ROOT'] . "/../../../site2.com/www/public_html/index.html"; and read that site's files.

How can I prevent this? I looked into chroot but each site's home directory has symlinks to /dotfiles that I need to keep and I assume nginx will need to access logs at /var/logs/nginx/...

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Have a look at open_basedir. There are a couple known ways to get around it, but these can be prevented in the config.

Why symlinks instead of hard links on the dotfiles?

share|improve this answer
    
Thanks, I'll look into it. Symlinks because I have some directories in my /dotfiles that I am linking. No way to use chroot with symlinks? –  Brandon Jan 17 '12 at 16:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.