Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I installed Apache with FastCGI (mod_fastcgi), suExec and PHP on my local development box. Working perfectly, except one thing.

Let's say I have two users:

user1 - /home/user1/public_html
user2 - /home/user2/public_html

I discovered a serious security hole in my configuration: I can include a file from user2 web root in user1 file. How to prevent? Any tips?

php-cgi process is running under correct user.

share|improve this question

3 Answers 3

I would suggest you set the base_path within your VirtualHost:

php_admin_value open_basedir /usr/local/www/sixeightzero
share|improve this answer

If the aim is to run php under the name of the users, to separate them then try apache2-mpm-itk, it is far more easy to deploy then fast-cgi and works great.

To use you need only to add this line to the virtualhost configuration:

AssignUserId someuser somegroup

You can also set MaxClientsVHost and NiceValue if you like.

share|improve this answer

The only way to do it right is to forbid one user to read files from homedir of another user but leaving them readable to webserver.

You can accomplish this by (example):

mount file system with acl options: mount -o acl /dev/sda /home

Allow webserver to access it:

setfacl -m u:nobody:r-x /home/user1

setfacl -m u:nobody:r-x /home/user2

Allow owner to read it:

setfacl -m u:user1:r-x /home/user1

setfacl -m u:user2:r-x /home/user2

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.