Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I’m having trouble with PHP-FPM and Apache 2.4.1 mod_proxy_fcgi. As mod_proxy_fcgi cannot handle Unix Sockets, PHP-FPM has to listen on localhost. Thus, anyone who has access to the server could send requests to PHP-FPM. I wasn’t able to restrict PHP-FPM to my document root, so someone could just create a malicous PHP file, make sure my PHP process has access to it and send a special crafted request to the port on which PHP-FPM listens. (I already tried it out, it worked.)

I have the following in my apache config:

<VirtualHost *:80>
   ServerName example.org

   DocumentRoot /srv/vhosts/example.org/vhostdata/public/

   <Directory /srv/vhosts/example.org/vhostdata/public/>
          Require all granted
   </Directory>


   <LocationMatch ^(.*\.php)$>
            ProxyPass fcgi://127.0.0.1:6001/srv/vhosts/example.org/vhostdata/public/
            ProxyErrorOverride On
   </LocationMatch>
 </VirtualHost>

How do I make PHP-FPM prepent the document root /srv/vhosts/example.org/vhostdata/public/ on every request it receives? I already played around with the chdir directive, but it does not suitable for my needs.

Unfortunately, using a chroot is not an option for me because I am running in a linux-vserver enviroment, where mknod has been disabled by the administrator for security reasons.

share|improve this question
    
You've really picked a whole bag full of inappropriate technologies there... –  womble Mar 19 '12 at 21:32
    
@womble: I’m starting to think so, too... so, what do you recommend? Using mod_fastcgi? –  Niko B Mar 19 '12 at 21:36
    
Yeah, mod_fastcgi has always worked for me. Getting out of the linux-vserver would be a winning strategy, too. –  womble Mar 20 '12 at 5:41

1 Answer 1

Running within a chroot is really your only option if you want to do this.

Do other people actually have access to run code on your machine? If so, I'd really suggest you switch to something that supports unix sockets, mod_fastcgi would be one option. The other option (if your app is compatible) is switching to nginx, which supports unix sockets for PHP.

If this is just worrying about security, I'd suggest you just tighten the permissions that PHP/Apache run as. If you can prevent malicious users from uploading files, you can prevent this exploit from ever occurring.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.