PHP shared server security

[Anon]

I have a client that brought to my attention a very interesting problem.

If he has a website (www.domain.com) and he has a php page on it (order.php) that connects to the database. He has the user and pass in the page.

ok.

This is a linux server.

It seems that another person on the server could just figure out what directory he is in.

Then just do "vi order.php"

so they could read the user and pass and then connect to the database and steal information.

or even steal the scripts

I hope I explained this ok.

Does anybody have a solution to this?

I sure hope so.

Visit http://[e-mail] for great deals

[Anon]

Adam - how ya been ? 😉

Well, easiest solution is the following, and here are the assumptions I am going to make.

Each user has their own directory off their home
This is all on the same instance of apache
The web server is running in group www (can be anything)
You are defaulting users to use /etc/profile

alter /etc/profile to change the umask to 0750 by default

Now, change the group of any directory and subsequent files to www (or the group of the web server) leave the owner as the user name.

now, here is the important part, in the user's home directory, (assuming you are using /home/user/public_html), make sure that you do a chmod g+s public_html .. this will set the group bit on the directory and cause all new files created to use that group.

Now, all files are created with them as the owner, in the web server group, so both can see and execute, but others can't. You'll probably want to add all of this into your adduser so it applies to all new accounts, but remember that if you change the group bit, or the group for that matter, of the directory in /etc/skel it won't carry over.

Hope that helps, and drop me a line

Chris King

[Anon]

No, there is no good solution, until Apache generation 2 is released.

Until then, you could:
1. Close off shell-access.
2. Configure your FTP-server to only allow people to work with files in their home directories.
3. Put PHP in "safe mode".

This makes it harder for people to look in other people's work.

But again:
The real solution will be Apache 2 which allows the web-server to run with different user IDs in different directories.
Actually, it's also possible with Apache 1, but it's rather difficult.

[Anon]

That is absolutely not true. If you control the apache config and set it up to use it's own group and user id (standard security measures) you can take full advantage of the unix file system permissions to let only the web server and the specific user that owns that web site access the data in a given directory. The method I presented was the most fool-proof way to execute this, the only way it would break is if a user forced their files to be insecure. Hope that makes sense.

Chris King

[Anon]

I'm sorry, but that certainly doesn't prevent other users on the same system to read un-parsed .php-files (which display passwords).

Since Apache may see all the involved files, it's only a question of writing some PHP code which uses fopen(), fread(), etc., on the file-system.

I think that there are even PHP-based file-browsers which you may download from Freshmeat which lets you browse around in all files readable by Apache.

Tricks may be made involving "--x" permissions on directories, thereby making it impossible to get directory-listings. However, this is easily circumvented because it's normally very easy to guess file-names of web-pages.

The only solid way to prevent that is to run PHP in CGI mode and use Apache's "suEXEC" facility to make the CGI-scrips be performed as different users. This means a big performance hit. Apache 2 will change that.

[Anon]

Chris, you are simply wrong.

If Apache can read a file, then every user on the server with access to uploading php-files may read the file - unless Apache's suEXEC is used to make Apache change user-ID depending on which directory is being read from.

[Anon]

Adam, you may consider this dirty hack:

I assume that your web-writers' file-area are initially World readable.

In each user's file-area root, you create a directory named "protected"
with 0751 permissions, equivalent to
drwxr-x--x

Make the directory owned by the web-writer's user and group (not Apache's).

Apache may then read files from that directory if it knows the exact name of the file to be read.

Finally, make httpd.conf readable by root only and put statements like these in the different <virtualhost> sections:

php_value auto_prepend_file "/home/web-user/protected/ksjdf723094sdklfjwer.php"

(All in one line; the file-name should be very hard to guess.)

Now, tell the web-writer that he/she may put secret stuff in ksjdf723094sdklfjwer.php

Repeat the procedure for each web-writer (each time with a different, hard-to-guess name for the protected file).

If you want to try this, then make sure that you are an expert on unix file permissions. Especially, you should know that it means to have x-permission on a directory, but not r-permission.