1

I've been using Apache with suexec and mod_fastcgi. It starts up PHP handlers as the selected system user and listens to request via PIPES (fastcgi protocol). It works well but can't share opcode via many handlers.

I've been investigating php-fpm approach. It's really badly documented. What I can see is that it only runs as TCP fastcgi server, like 127.0.0.1:9999, under selected system user, and Apache has to connect to it using FastCGIExternalServer or fastcgi proxy mod.

What will stop other local users from connecting to 127.0.0.1:9999 and passing their own code to handler that is running as other system user?

That seems totally not secure in shared environment. Am I missing something or what?

1
  • I found an answer. php-fpm can listen on sockets (+chmod). mod_fcgi does actualy the same.
    – user172372
    May 4, 2013 at 3:59

1 Answer 1

0

Yes, they can send requests, but how is that any different than them doing a request in their browser or wget? All they'll get is the php output.

They could cause problems by pounding your php-fpm server with requests. But any input they can send should be handled as well as if it came from a browser request.

But, they are stepping in after any apache/nginx security checks might have been done, like mod_security etc. So that might be a concern if you have a vulnerable php application.

But if you have your pools set up to run each pool as a separate user and you keep php files set not-world-readable it shouldn't be too bad, unless I'm missing something too.

4
  • it is totaly diffrent from requesting webpage in browser because webpage does not allow you to pase you own php code for execution (and fastcgi tcp server does exacly that).
    – user172372
    May 4, 2013 at 3:58
  • anyway, I found an answer. php-fpm can listen on sockets (+chmod). mod_fcgi does actualy the same.
    – user172372
    May 4, 2013 at 3:58
  • how do you pass in code that gets executed in php-fpm? it's a browser request that gets passed in
    – troseman
    May 4, 2013 at 4:55
  • if you think about it, if you can pass in any code and execute it using a service visible to the web, you're screwed. I don't believe fastcgi does that either.
    – troseman
    May 4, 2013 at 5:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .