Tag Info

Hot answers tagged

12

Using suexec and suphp enforce a different type of privilege separation than the default. The default is to separate the user's permission from the web server. That is, the user owns the files, and he has to grant the web server permission to view and change them. The suexec/suphp model is that the webserver (when running scripts) runs under the user's ...


6

PHP-FPM is a patch for PHP to provide some advanced process management features which are useful when used in its FastCGI variant. On a side note, PHP 5.4 will probably include PHP-FPM out of the box (according to Antony Dovgal). Since mod_fcgid doesn't support externally spawned FastCGI servers, you need to use mod_fastcgi or mod_proxy_fcgi. Google found ...


5

This warning comes up because you define a NameVirtualHost for 12.345.67.89:443 but there is no <VirtualHost 12.345.67.89:443>. So, change to NameVirtualHost *:443, it will go away.


5

Yum/apt-get just cheats the system This is utter nonsense. Tools like these are the only sensible option to manage software installations. After they did their work (with useful default configurations), you can configure the installed software exactly like you need it. To learn how the system really works, have a look at Linux from Scratch.


4

You're using ubuntu. Therefore recompile is pretty simple. Add source repository to your /etc/apt/sources.list . For 12.04 run echo "deb-src http://de.archive.ubuntu.com/ubuntu/ precise main"|sudo tee -a /etc/apt/sources.list change de.archive.ubuntu.com to whatever country you're in. After that update your repository. apt-get update Change dir and ...


4

There are (usually default) security restrictions in place inside php.ini to prevent scripts from using too much memory, executing certain functions or generally doing what they shouldn't. If you allow PHP to execute a shell script which isn't restricted in this manner, you're opening up the possibilities for attackers. For instance, they could run a fork ...


4

suPHP does this very well. There is a solution with Apache by using setuid and setgid.


3

suexec only executes programs within an apache document root. See the suexec security model, particularly point 13.


3

Running PHP under the web server's permissions isn't isn't necessarily better or worse than using SuPHP. It's just different. The first model separates the owner from the web server, while the second model separates the owner (and his PHP code) from all the other users on the machine. Using suPHP doesn't necessarily increase your overall security, it just ...


3

<Directory /srv/www/hostname/public> Order allow,deny Allow from all </Directory> That doesn't include /srv/www/hostname/fcgid-bin/; assuming there's no Allow applying to it elsewhere in your config, this is the problem. You'll need to Allow access to this location.


3

Or you can apt-get install apache2-suexec-custom after install go to cd /etc/apache2/suexec edit the file vi www-data You can see the first 2 lines, make the changes: replace /var/www with /home esc :wq after, restart apache /etc/init.d/apache2 restart


3

Your question is not completely clear. If I get it: So is there anyway to upload file with account owner under mod_php(php5_module)? No. You can run Apache as a particular user, but then all scripts will run at them (including all PHP ones), which probably isn't what you want. If you want to have PHP scripts run as their respective user, you'll need ...


3

Personally, I'd just NFS mount twice in two different locations. You don't need to export/mount separately, as you can mount subdirectories of an NFS export directly.


2

You don't need to recompile it. You can use this package to set a custom path on debian or ubuntu: apt-get install apache2-suexec-custom If you don't have debian or ubuntu, you have to look for such a package or recompile suexec with the right docroot (see suexec doc). The param is: --with-suexec-docroot=DIR You have to check, how to do it for your ...


2

Yes, it would. suPHP and/or using FastCGI would also work. On a more general note, I'd be very wary about the coding practices (especially around security) of anyone who thought that chmod 0777 was the solution to a permissions problem. You might be installing an invitation to a giant pwn party on your server.


2

Good question -- shows you've done your homework. I can't think of anything "obvious" that you've failed to check, so I can only give you some more advanced debugging advice. Fire up strace on the PHP process, and see exactly what it's doing under the hood. Write a bit of code that does an fopen(..., 'r') to triple-check that your directory tree ...


2

I doubt you'll find this neatly written up from a reliable source. I think the answer to your headline question is to take a look at suPHP. Unfortunately the documentation is rather sparse. Out of the box suPHP is compiled in paranoid mode which means that you have to set the user and group that you want PHP to run as with the suPHP_UserGroup directive on ...


2

Tomcat only runs as a single (multi-threaded) process, so there's no way to have apps deployed to the same $CATALINA_BASE run as different users. You'll have to install separate Tomcat instances (or at least set up separate $CATALINA_BASE directories) if you have to run different webapps under different users. If you want to run as different users because ...


2

This is a bad idea. Use PAM to move the authdb into something like a database where you don't need to invoke system tools in order to make changes.


2

Trac is written in Python and supports running under mod_wsgi (per an item in the FAQ), so I'd drop several of those moving parts and switch to the fantastic mod_wsgi, which supports specifying a user for a script to run as. I use this functionality for another project and it works well. Checking for the official mod_wsgi docs, to point you at how this is ...


2

I'm using the IUS RPMs from Rackspace, and suexec came compiled and configured by default. Here are the pertinent parts of my mod_fcgid config: LoadModule fcgid_module modules/mod_fcgid.so AddHandler fcgid-script fcg fcgi fpl php DefaultInitEnv PHPRC "/etc/" FCGIWrapper /usr/bin/php-cgi .php I suggest removing the "ScriptAliasMatch" Directive and ...


2

i think, under apache suEXEC will do the job.


1

It appears that by default the the public_html folder has permissions of 750, I changed to 755 and updated the open_basedir restrictions and all started to work great. I just have to make sure that I can still have a .htaccess per site.


1

First of all, if the owner of a file doesn't need to have write access, don't give it to them. You can do this by setting the first number of the UNIX permissions. This means that only root will have write access to their files. This will be very annoying when they will need to upgrade files but you have said that they shouldn't have write access.... ...


1

Nowadays the way to go isn't apache and suexec at all. Try using lighttpd and php-fastcgi; this gives you excellent process isolation and performance: php is always running, and each user gets their own, but they don't bloat the memory of the web server itself. http://redmine.lighttpd.net/wiki/1/TutorialLighttpdAndPHP


1

I'd say you should check out 3 main lightweight servers. Each work using php-fastcgi (or something similar) and all have their pros and cons. www.cherokee-project.com www.cherokee-project.com/doc/cookbook_php.html www.cherokee-project.com/doc/cookbook_wordpress.html www.cherokee-project.com/doc/cookbook.html nginx.org wiki.nginx.org/NginxConfiguration ...


1

If you have access to apache httpd.conf, you can enable and configure mod_status with your IP and when the process starts taking the cpu, load up the page and search for processID


1

It require you to be a experienced linux administrator to following the link http://httpd.apache.org/docs/1.3/suexec.html#install Otherwise, I strongly recommend you to ask GoDaddy support to do the job for you. Submit a support ticket there.


1

suexec won't necessarily be listed in the output from httpd -l if apache is DSO. Look in your error_log on startup for the following string: [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)


1

If so, what would be the best way to achieve the proposed security solution? Best use virtual machine(KVM,OpenVZ,XEN,Jail) for each site or use chroot(mod_chroot,php-fpm).



Only top voted, non community-wiki answers of a minimum length are eligible