Date: Tue, 29 Jul 2003 18:58:26 +0100 From: Jez Hancock <jez.hancock@munk.nu> To: FreeBSD ISP List <freebsd-isp@freebsd.org> Subject: Re: Virtual Hosting Security Message-ID: <20030729175826.GB68275@users.munk.nu> In-Reply-To: <007d01c355f4$8e54a900$6b026b83@marco> References: <007d01c355f4$8e54a900$6b026b83@marco>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Jul 29, 2003 at 06:12:04PM +0100, Marco Gon?alves wrote: > Dear ISP collegues, <snip> > the problem is that we offer php4 as a mod_php4 for Apache and even though we didnt had (yet) no problem in theory is ease to set up a php script using filesystem functions to run, list and view file contents of other users...cause the script is runing as www user and this user has permissions to enter/read all users www directory.... how can i fix this? must i use suexec? does it run properly? do i have to put php as cgi only? what is the tradeoff in performance? One way to stop users from snooping on other users whilst using mod_php4 is to use the apache PHP directive open_basedir in each VirtualHost stub to 'lock' user's PHP scripts into their own DocumentRoot: <VirtualHost *> ... php_admin_value open_basedir /home/user/documentroot </VirtualHost> Unfortunately this still means that PHP scripts are executed by the apache user and so if PHP scripts send out emails and those emails bounce, the bounce is directed to your 'www' user instead of the user that owns the script. Similarly if php scripts create files, they will be owned by the apache user instead of the EUID of the owner of the script. Right now we're experimenting with various PHP CGI wrappers so that PHP scripts are run with the EUID of the owner of the script. suPHP is one such PHP wrapper and has just been ported in /usr/ports/www/suphp - however there is a fundamental flaw in the port that allows scripts owned by root to be executed regardless of the MIN UID check - not good of course. If you know anything about C feel free to check it out :) Other solutions are mod_suid, mod_become, sbox, suexec + php patch, ... any others? > Other thing (maybe this shoul be on other email...) we are developping our own control panel, and for system password we are using a PHP script that uses poppassd on port 106 that does all the work. The problem is that i have to run poppasswd from inetd, and this sucks specially cause its the only service that i need inetd... can i run it from tcpserver? How? Where can i found good info on this (the documentation on DBernstein site really sucks for a not so experienced sys admin like me)? Is it safe (poppassd i mean)? I know nothing about poppassd, but an alternative might be to check out the cyrus authentication suite perhaps - particularly the pwcheck daemon which doesn't need to be run via inetd. -- Jez http://www.munk.nu/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030729175826.GB68275>