Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using suphp, I set a php.ini to every virtual host. In php.ini I also setted:

open_basedir = /home/site1

php script runs, but if I ve a script with ls / I can see whole root directory.

How can disable this hole security?

<VirtualHost *:80>
ServerName site1

DirectoryIndex index.html index.htm
DocumentRoot /home/site1/

suPHP_Engine on
AddHandler x-httpd-php .php .php3 .php4 .php5
suPHP_AddHandler x-httpd-php

# THIS READ php.ini
suPHP_ConfigPath /home/site1/

<Directory /home/site1/>

Options -Includes -Indexes -FollowSymLinks -ExecCGI -MultiViews
AllowOverride none
Order allow,deny
Allow from all
share|improve this question

You can disable the execution of external binaries to get rid of this behavior.

UPDATE you can do it this way, you have to edit your php.ini


(I included line breaks for clarity.)

This is the original URL:

share|improve this answer
Thanks, how can I disable it? – Pol Hallen Jun 30 '13 at 19:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.