Secure PHP environments with PHP-FPM and SFTP

Question

I'd like to set up secure environments for a small number of untrusted PHP websites on a Debian server. Right now everything runs on the same Apache2 with mod_php5 and vsftpd for administrative file access, so there is room for improvement.

The idea is to use nginx instead of apache, SFTP through OpenSSH instead of vsftpd and chrooted (in sshd_config), individual users for each website with their own pool of PHP processes. All these users and nginx are part of the same group.

Now in theory I can set 700 permissions on all PHP scripts and 750 on static files that nginx has to serve up. Theoretically, if a website is compromised all the other users' data is safe, right?

Are there better solutions that require less setup time and memory per website?

Cheers

Answer 1

Using the chroot directive inside php-fpm configuration, should guarantee enough security; then allowing the users to stay only inside the chrooted ftp (or scp), would be enough with the correct configuration of Apache (don't let symlinks fool him! :P).
Then, having everything chrooted, should be enough: you wouldn't even need to set che permissions on the files since they wouldn't be readable from another chrooted environment. :)
Other solutions, making you avoid to consume memory is possible... just use caching with varnish or something similar (I do know it wouldn't be that easy to configure for untrusted users btw).

Answer 2

Taking into consideration your desired to-do configuration for nginx, I've just came across a great bash script designed for use on Debian and Ubuntu which automates most of the tasks one needs to perform in order to achieve a similar setup scenario as the one you described.

The bash script automates the creation of new virtual hosts (server blocks) on nginx, and allows you to run multiple pools of PHP. PHP-FPM processes all spawned from the master one and to have each pool running as a different user and/or group. Each pool can be further isolated by running in a chroot environment and by overriding the default php.ini values on a per pool basis.

Check it out at the developer's website:

http://www.sebdangerfield.me.uk/2012/05/nginx-and-php-fpm-bash-script-for-creating-new-vhosts-under-separate-fpm-pools/

What else does the script do:

• Creates a new system user for the site
• Creates a new vhost config file for nginx using a basic template
• Creates a new PHP-FPM pool with the uid and gid set to that of the new system user
• Creates a new directory for the site, within the new users home directory
• Reloads Nginx to allow the new vhost to be detected
• Restarts PHP-FPM to generate the new pool of PHP workers

I hope it helps you to optimize your setup time.