0

After some fooling around with PHP-FPM user pools, I got a configuration that works... but is right?

I'm self hosting a PrivateBin. Obviously, I'm trying to get this install as secure as possible but this is my first time setting up PHP-FPM user pools.

Following these instructions I setup the permissions. My concern is that this app won't run without write and execute privileges to the traffic_limiter.php file located in the data directory. This obviously concerns me.

User Configuration I created a user called privatebin and also created the appropriate pool in /etc/php/7.2/fpm/pool.d/privatebin.conf.

[privatebin]
user = privatebin
group = privatebin
listen = /run/php/php7.0-fpm.privatebin.sock
listen.owner = privatebin      
listen.group = www-data    
listen.mode = 0660

pm = dynamic
pm.max_children = 5
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 3

I also added the following to the virtual host file.

  <IfModule mod_fastcgi.c>
    AddHandler php7-fcgi-privatebin .php
    Action php7-fcgi-privatebin /php7-fcgi-privatebin
    Alias /php7-fcgi-privatebin /usr/lib/cgi-bin/php7-fcgi-privatebin
    FastCgiExternalServer /usr/lib/cgi-bin/php7-fcgi-privatebin -socket /run/php/php7.0-fpm.privatebin.sock -pass-header Authorization
    <Directory "/usr/lib/cgi-bin">
      Require all granted
    </Directory>
  </IfModule>

  <Directory /var/www/bin.xxxx.io/html>
    Options +SymLinksIfOwnerMatch
    AllowOverride None

    Require all granted
    RewriteEngine On
    <IfModule mod_fastcgi.c>
      <FilesMatch ".+\.ph(p[3457]?|t|tml)$">
        SetHandler php7-fcgi-privatebin
      </FilesMatch>
    </IfModule>
  </Directory>

The pooled user appears to be working.

#$ps aux | grep php
private+  1532  0.0  0.1 717056 22780 ?        S    11:22   0:00 php-fpm: pool privatebin
private+  1533  0.0  0.1 717056 22780 ?        S    11:22   0:00 php-fpm: pool privatebin
www-data  1534  0.0  0.9 806716 149296 ?       S    11:22   0:05 php-fpm: pool www
www-data  1539  0.0  0.9 1041968 150420 ?      S    11:22   0:03 php-fpm: pool www
www-data  2299  0.0  0.8 1039040 144136 ?      S    12:25   0:02 php-fpm: pool www

Finally... here are the file permissions.

/var/www/html
dr-xr-x---  2 root       www-data 4096 Apr  2 11:20 cfg/
dr-xr-x---  4 root       www-data 4096 Aug 11  2018 css/
drwxr-x---  2 privatebin www-data 4096 Apr  2 13:04 data/
dr-xr-x---  2 root       www-data 4096 Aug 11  2018 i18n/
dr-xr-x---  2 root       www-data 4096 Aug 11  2018 img/

/var/www/html/data
-rw-r-----  1 privatebin www-data   19 Apr  2 13:04 .htaccess
-rwxrw----  1 privatebin www-data   45 Apr  2 13:26 purge_limiter.php*
-rwxrw----  1 privatebin www-data  522 Apr  2 06:57 salt.php*
-rwxrw----  1 privatebin www-data  130 Apr  2 13:26 traffic_limiter.php*

As I said, this appears to be working, but I had to fiddle with the user permission to get them right. An advise is greatly appreciated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.