I want to configure an NGINX server, which is able to host multiple websites, which are seperated from each other, so
vhosta can't access files from
I installed a fresh Debian 7.5 server and installed NGINX and PHP FPM from the default debian packages.
Then I'll added 2 new users
vhostb and added the NGINX webserver user
www-data to the group of each user.
Next I created the following directory structure.
var/ |---www/ |---vhosta |---httpdocs (permissions 750 - owner: vhosta - group: vhosta) |---vhostb |---httpdocs (permissions 750 - owner: vhostb - group: vhostb)
I configured an individual PHP FPM pool for each virtual host to seperate the PHP processes for each virtual host. The configuration is as following (just showing for
[vhosta] listen = /var/run/php5-fpm-vhosta.sock user = vhosta group = vhosta listen.owner = vhosta listen.group = vhosta
From my knowledge, this configuration should seperate
vhosta from accessing files in
vhostb's httpdocs directory, since
vhosta does not have access permissions to the httpdocs folder from
vhosta. I verified this, by trying creating a simple PHP script in
vhosta, which tries to access files in
vhostb's httpdocs directory.
So far, so good. I installed a PHP application (CMS) in
vhosta and did some performance testing with ApacheBench.
Generally, everything runs more smooth and fast than with Apache2 and I'll end up with the following result.
Requests per second: 31.62 [#/sec] (mean) Time per request: 316.209 [ms] (mean) Time per request: 31.621 [ms] (mean, across all concurrent requests) Transfer rate: 430.58 [Kbytes/sec] received
Well, 31.62 requests per second is fine for me at this point.
Last I want to access restrict both
vhostb to a subset of directories, so they do not have access to other world readable system files. I do so, by using the PHP directive open_basedir.
I have added the following to each virtial hosts PHP FPM pool (just showing
php_admin_value[open_basedir] = /var/www/vhosta/httpdocs/:/tmp/
Doing so, the vhosts should not be able to access e.g. /etc/passwd. I created a simple PHP script, which verifies, that the vhosts can't access files outside from the configured directories.
Finally, I repeated the performance test and end up with the following result.
Requests per second: 11.82 [#/sec] (mean) Time per request: 8460.087 [ms] (mean) Time per request: 84.601 [ms] (mean, across all concurrent requests) Transfer rate: 161.18 [Kbytes/sec] received
It seems, that adding an open_basedir directive to the PHP FPM pool causes a big performance decreasement. Access times and the amount of requests per second is now fairly similar compared to a setup using Apache2 with mod_php.
My questions are as following:
Can the setup I created be considered as "secure", so the individual vhosts can't access each other? If not, what is best practice to do so and what am I missing?
Why does the performance decrease so much, when I use open_basedir? Or is it save to not use open_basedir, since files like /etc/passwd are world readable anyway?