Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been using Apache with suexec and mod_fastcgi. It starts up PHP handlers as the selected system user and listens to request via PIPES (fastcgi protocol). It works well but can't share opcode via many handlers.

I've been investigating php-fpm approach. It's really badly documented. What I can see is that it only runs as TCP fastcgi server, like 127.0.0.1:9999, under selected system user, and Apache has to connect to it using FastCGIExternalServer or fastcgi proxy mod.

What will stop other local users from connecting to 127.0.0.1:9999 and passing their own code to handler that is running as other system user?

That seems totally not secure in shared environment. Am I missing something or what?

share|improve this question
    
I found an answer. php-fpm can listen on sockets (+chmod). mod_fcgi does actualy the same. –  user172372 May 4 '13 at 3:59

1 Answer 1

Yes, they can send requests, but how is that any different than them doing a request in their browser or wget? All they'll get is the php output.

They could cause problems by pounding your php-fpm server with requests. But any input they can send should be handled as well as if it came from a browser request.

But, they are stepping in after any apache/nginx security checks might have been done, like mod_security etc. So that might be a concern if you have a vulnerable php application.

But if you have your pools set up to run each pool as a separate user and you keep php files set not-world-readable it shouldn't be too bad, unless I'm missing something too.

share|improve this answer
    
it is totaly diffrent from requesting webpage in browser because webpage does not allow you to pase you own php code for execution (and fastcgi tcp server does exacly that). –  user172372 May 4 '13 at 3:58
    
anyway, I found an answer. php-fpm can listen on sockets (+chmod). mod_fcgi does actualy the same. –  user172372 May 4 '13 at 3:58
    
how do you pass in code that gets executed in php-fpm? it's a browser request that gets passed in –  Avibodha May 4 '13 at 4:55
    
if you think about it, if you can pass in any code and execute it using a service visible to the web, you're screwed. I don't believe fastcgi does that either. –  Avibodha May 4 '13 at 5:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.