Tag Info

Hot answers tagged

12

Using suexec and suphp enforce a different type of privilege separation than the default. The default is to separate the user's permission from the web server. That is, the user owns the files, and he has to grant the web server permission to view and change them. The suexec/suphp model is that the webserver (when running scripts) runs under the user's ...


7

Or you can apt-get install apache2-suexec-custom after install go to cd /etc/apache2/suexec edit the file vi www-data You can see the first 2 lines, make the changes: replace /var/www with /home esc :wq after, restart apache /etc/init.d/apache2 restart


6

PHP-FPM is a patch for PHP to provide some advanced process management features which are useful when used in its FastCGI variant. On a side note, PHP 5.4 will probably include PHP-FPM out of the box (according to Antony Dovgal). Since mod_fcgid doesn't support externally spawned FastCGI servers, you need to use mod_fastcgi or mod_proxy_fcgi. Google found ...


5

Good question -- shows you've done your homework. I can't think of anything "obvious" that you've failed to check, so I can only give you some more advanced debugging advice. Fire up strace on the PHP process, and see exactly what it's doing under the hood. Write a bit of code that does an fopen(..., 'r') to triple-check that your directory tree ...


5

This warning comes up because you define a NameVirtualHost for 12.345.67.89:443 but there is no <VirtualHost 12.345.67.89:443>. So, change to NameVirtualHost *:443, it will go away.


5

Yum/apt-get just cheats the system This is utter nonsense. Tools like these are the only sensible option to manage software installations. After they did their work (with useful default configurations), you can configure the installed software exactly like you need it. To learn how the system really works, have a look at Linux from Scratch.


4

Your question is not completely clear. If I get it: So is there anyway to upload file with account owner under mod_php(php5_module)? No. You can run Apache as a particular user, but then all scripts will run at them (including all PHP ones), which probably isn't what you want. If you want to have PHP scripts run as their respective user, you'll need ...


4

You're using ubuntu. Therefore recompile is pretty simple. Add source repository to your /etc/apt/sources.list . For 12.04 run echo "deb-src http://de.archive.ubuntu.com/ubuntu/ precise main"|sudo tee -a /etc/apt/sources.list change de.archive.ubuntu.com to whatever country you're in. After that update your repository. apt-get update Change dir and ...


4

There are (usually default) security restrictions in place inside php.ini to prevent scripts from using too much memory, executing certain functions or generally doing what they shouldn't. If you allow PHP to execute a shell script which isn't restricted in this manner, you're opening up the possibilities for attackers. For instance, they could run a fork ...


4

suPHP does this very well. There is a solution with Apache by using setuid and setgid.


3

suexec only executes programs within an apache document root. See the suexec security model, particularly point 13.


3

Running PHP under the web server's permissions isn't isn't necessarily better or worse than using SuPHP. It's just different. The first model separates the owner from the web server, while the second model separates the owner (and his PHP code) from all the other users on the machine. Using suPHP doesn't necessarily increase your overall security, it just ...


3

<Directory /srv/www/hostname/public> Order allow,deny Allow from all </Directory> That doesn't include /srv/www/hostname/fcgid-bin/; assuming there's no Allow applying to it elsewhere in your config, this is the problem. You'll need to Allow access to this location.


3

Personally, I'd just NFS mount twice in two different locations. You don't need to export/mount separately, as you can mount subdirectories of an NFS export directly.


2

First of all, you're overkilling it. You don't need suphp + php-fpm since they basically do the same thing. If you want multi-user multi-vhost enviroment you should be using the following stack: apache+mod_fastcgi+php-fpm php-fpm allows you to define pools that can run under different user with totally different php settings. For that configuration you ...


2

You don't need to recompile it. You can use this package to set a custom path on debian or ubuntu: apt-get install apache2-suexec-custom If you don't have debian or ubuntu, you have to look for such a package or recompile suexec with the right docroot (see suexec doc). The param is: --with-suexec-docroot=DIR You have to check, how to do it for your ...


2

in practice the dynamic vhost feature is not optimal, because you are not flexible enough (.htaccess is in some cases not enough). use a script to generate the vhosts or use something like puppet to define the vhosts (https://github.com/puppetlabs/puppetlabs-apache). btw: for your php setup i would use php-fpm (ondemand) with (mod_proxy_fcgi or ...


2

What flavor of Linux? Try /var/log/apache2/suexec.log, but looks like suexec (Apache) does not have permissions to write to the log file. Appears to be a bot looking for vulnerable scripts.


2

On the specific topic of using exec in php and how to be safe, The only thing you need to take care of is to escape arguments. i.e. don't do this: exec('myscript ' . $_POST['arg']); if it's not obvious - just think about what happens if $_POST['arg'] contains ; rm xyz - or worse, if you are sending the output of that command to the screen and it contains ...


2

Yes, it would. suPHP and/or using FastCGI would also work. On a more general note, I'd be very wary about the coding practices (especially around security) of anyone who thought that chmod 0777 was the solution to a permissions problem. You might be installing an invitation to a giant pwn party on your server.


2

try /usr/sbin/apachectl -t -D DUMP_MODULES check that all modules enabled If you get Warning: SuexecUserGroup directive requires SUEXEC wrapper. Resolution Such warning is usually caused by invalid permissions on suexec wrapper, it should be: # ls -la /usr/sbin/suexec -rwsr-xr-x 1 root root 12064 2008-04-17 01:15 /usr/sbin/suexec If the permissions ...


2

I doubt you'll find this neatly written up from a reliable source. I think the answer to your headline question is to take a look at suPHP. Unfortunately the documentation is rather sparse. Out of the box suPHP is compiled in paranoid mode which means that you have to set the user and group that you want PHP to run as with the suPHP_UserGroup directive on ...


2

Tomcat only runs as a single (multi-threaded) process, so there's no way to have apps deployed to the same $CATALINA_BASE run as different users. You'll have to install separate Tomcat instances (or at least set up separate $CATALINA_BASE directories) if you have to run different webapps under different users. If you want to run as different users because ...


2

This is a bad idea. Use PAM to move the authdb into something like a database where you don't need to invoke system tools in order to make changes.


2

Trac is written in Python and supports running under mod_wsgi (per an item in the FAQ), so I'd drop several of those moving parts and switch to the fantastic mod_wsgi, which supports specifying a user for a script to run as. I use this functionality for another project and it works well. Checking for the official mod_wsgi docs, to point you at how this is ...


2

I'm using the IUS RPMs from Rackspace, and suexec came compiled and configured by default. Here are the pertinent parts of my mod_fcgid config: LoadModule fcgid_module modules/mod_fcgid.so AddHandler fcgid-script fcg fcgi fpl php DefaultInitEnv PHPRC "/etc/" FCGIWrapper /usr/bin/php-cgi .php I suggest removing the "ScriptAliasMatch" Directive and ...


2

i think, under apache suEXEC will do the job.


1

It appears that by default the the public_html folder has permissions of 750, I changed to 755 and updated the open_basedir restrictions and all started to work great. I just have to make sure that I can still have a .htaccess per site.


1

First of all, if the owner of a file doesn't need to have write access, don't give it to them. You can do this by setting the first number of the UNIX permissions. This means that only root will have write access to their files. This will be very annoying when they will need to upgrade files but you have said that they shouldn't have write access.... ...


1

Nowadays the way to go isn't apache and suexec at all. Try using lighttpd and php-fastcgi; this gives you excellent process isolation and performance: php is always running, and each user gets their own, but they don't bloat the memory of the web server itself. http://redmine.lighttpd.net/wiki/1/TutorialLighttpdAndPHP



Only top voted, non community-wiki answers of a minimum length are eligible