Tagged Questions

0
votes
1answer
32 views

Security implications of running Apache with php5-fpm as user:user

I just set up VPS to run Apache with php5-fpm which is set to run every user pool as user:user. Reason for this is simply to allow users to actually own their own files created by various CMS ...
2
votes
1answer
86 views

Overhead of many php-fpm processes on Linux?

I'm migrating the configuration of a webserver that runs PHP applications using PHP-FPM behind nginx. The server has about 40-50 (and growing) vhosts on it. The server is a single CPU VM with 1GB of ...
1
vote
2answers
68 views

php security on a system with only known php software (or: need alternative non-PHP CMS)

I have a deep antipathy for PHP due to its security record and the way the project handles security in general. Unfortunately I have to deploy a CMS and I need a modern theme for it. So far I have ...
2
votes
1answer
131 views

who should own the web root of my server?

I read a book about security in web servers and I found this: If your web server has the ability to write to the files in your WordPress directories, then the automatic upgrade functionality ...
1
vote
2answers
566 views

Securing PHP via open_basedir based on script path

I have several users running PHP scripts on a server and I'd like to lock it down so that their scripts can only access files in their www directory (it doesn't use linux user accounts, so there isn't ...
0
votes
2answers
213 views

User uploaded files on different server with PHP?

If I had a dozen "Work" servers with just PHP-FPM (with other Nginx servers in front), is it possible to setup PHP to store user uploaded files on a different server? I'm looking to avoid syncing ...