0

I've use to use a combination of suPHP with suExec in order to try to protect the users and limiting the PHP/Perl from running out of their allowed space (i.e.: user/tmp folders).

Its been a while since I last done such configuration I could say a few years, until today I was not in need of it and since then, some new modules came in.

  • I would like to know what are the modules currently available for this task that are worth using or my setup is still valid and worth using ?

  • I've also noticed that some companies setup their ftp server so it won't show files that start with a dot is there any specific reason they would want that ? I mean in many cases users would like to be able to download/edit/reupload their .htaccess file while it is possible to upload the said file, you would not be able to download it in this specific case.

PS: I do understand that CHMOD play a big hole on all this but like wise forcing Apache to run as the user in question is also needed.

3
  • 'dot files' - or files which start with a dot are hidden files on Linux / Unix, hence a lot of stuff doesn't show them by default. Do 'ls' in bash and you wont see dot files, do 'ls -a' and you will.
    – floodpants
    Mar 11, 2013 at 9:57
  • @drinxy I am sorry you failed to understand the question, I know how to make then show on the ftp, and I also know they are hidden files. What I am asking is from a security perspective why would they want to hide those files when some of them are needed by apache such as .htacces
    – Prix
    Mar 11, 2013 at 10:36
  • ah, that makes a bit more sense. I personally have never had a need to stop people downloading dot files (via ftp). If the user has access to upload a copy of the file and overwrite the existing one, then in my view the only reason you would need to stop people downloading them is if they contain something you don't want them to see. So in essence, no, I don't see any reason for the scenario you described.
    – floodpants
    Mar 12, 2013 at 3:05

2 Answers 2

1

What modules are you talking about?

If it were just PHP or Perl, the solution would be a lot simpler. Running scripts via CGI has a huge performance overhead, and IIRC it makes opcode caching impractical. With PHP alone you can simply set base_opendir and disable the extensions which can bypass it.

However php-fpm allows for pools of php interpreters to be run as different users (each pool listening on a different port) hence if the number of users is manageable, this might be a better solution for the PHP scripts.

1
  • for instance fastCGI, suPHP, suExec, mod_ruid2, etc.
    – Prix
    Mar 11, 2013 at 11:01
1

I would like to know what are the modules currently available for this task that are worth using or my setup is still valid and worth using ?

There are lots of modules (you even listed a bunch of them in one of your comments: for instance fastCGI, suPHP, suExec, mod_ruid2, etc.). They each have their particular strengths and weaknesses. Only you can prevent forest fires decide which module meets your specific needs -- evaluate the available options against your requirements and make the choice that best suits your needs.


I've also noticed that some companies setup their ftp server so it won't show files that start with a dot is there any specific reason they would want that ?

Because that's the way Unix has worked for 40+ years (filenames beginning with . are considered "hidden" and not shown in directory listings by default to remove clutter).
(Alternative answer: "Because that's how the local administrator wants it.")

you would not be able to download [the .htaccess file] in this specific case.

Wrong.
The dotfile convention only affects whether or not something is displayed by default.
dotfiles (or anything considered "hidden" by the host OS) can still be accessed directly by name, and shown in a directory listing by specifying the -a option to ls.

To be abundantly clear: naming a file with a leading . is a cosmetic considerations, not a security one.

Not the answer you're looking for? Browse other questions tagged .