PHP/Apache Security

Anon

I'm trying to put together a virtual hosting service... How would I prevent a PHP script from accessing another site's page that is hosted by the same server? In order for the page to be served, Apache must have rights to it... but with PHP, anyone with PHP access can simply go copy all the PHP code. How can access be restricted in a condition like this, without having separate servers?

sepodati

This is one of the problems with shared or virtual servers...I don't think there is any way around it...

---John Holmes...

Anon

I dunno if i understand you right

but under linux, you just have to assgin file owner option for each "site" - by chown

Luck

sepodati

Since php runs as a certain user, say "nobody", then "nobody" has to have permission to all of the PHP files on the server. So i could use a php script to access another php script in someone else directory. Say their config.php file, read it in, and copy it to my dir. then i've got their login and password for the mysql database, etc...

That's the problem...

---John Holmes...

billford

The way to do it is (and this would not be efficient on a large hosting site) but it's the way I do it in my larger sites. I setup Apache/PHP as different users, so if it's client X then only client X web server user can access read those files. This would give you file level security so that one Apache/PHP instance can't access another's files. You can also compile PHP to have different php.ini files per instance using
--with-config-file-path=PATH at configure time. This is also great because if your user does something stupid to bring down the server it won't effect your other customers.

billford

Ooops I should've read, you said "without having separate servers" sorry, that really is the best way.

smarlowe

You need to use the su-exec ability of apache. it basically launches the apache httpd daemon for a given virtual host to that of the directory owner, which, in turn, makes php run as that user as well.

jariizumi

suEXEC will only take effect for CGI modules as far as I've seen. This will only apply to PHP when it's running in CGI mode. Or is it something wrong I've done?

billford

I felt bad since not reading correctly in the first place. :-) If you have suExec enabled and you're using Virtual Hosts, you can use user and group directives in Apache. This would achieve the same effect as my above post. I've never done it this way, but hey it's in the docs. :-)

http://httpd.apache.org/docs/vhosts/ip-based.html

smarlowe

I hope it will work for you. I've been thinking of implementing this exact setup on a large machine for intranet use and testing, but haven't really had time.

ruttiger

Well, i thought i had the perfect solution, but it turns out this probably won't work:

use auto_append_file for customers' virtualhosted site. append a phps include file, which would undefine, then redefine fopen to make sure the file was in the document root. apparently you can't redefine existing functions.

any ideas similar to this?