Re: have anyone seen a working fastcgi/php isntallation..?

Hey there!

Yeah, I had the same problem with PHP/FastCGI and I was not able to
resolve it 'til now. So I reverted back to mod_php (because suphp is
just tooo slow) and set it up in a bit more secure way:
-) use safe_mode On
-) use open_basedir for every vhost
-) set upload_tmp_dir to a separate directory for each vhost
-) set disable_functions to  	
	passthru,proc_close,proc_get_status,proc_nice,proc_open,
	proc_terminate,shell_exec,apache_note,apache_setenv,closelog,
	debugger_off,debugger_on,define_syslog_variables,openlog,
	popen,pclose,syslog,wget,curl,puf
-) disable PHP by default and enable it for every vhost that needs it

With that approach all PHP scripts are executed as www-data, but the
dangerous stuff is disabled and PHP can't break out of the directories
defined in open_basedir. Theoretically. Practically it works perfect and
I don't think someone can harm the system very easily.

Best regards,

Mike

Divák Ádám wrote:
> hello guys,
> 
>  i still have the problem of setting up a secure&fast webspace - it
>  seems to be much more difficult than i thought.
>  so what i have: a debian system (maybe the only constant thing in
>  this setup..), apache2 (tried with
>  2.0.54-5 and 2.0.55-4, both custom-built from the original deb
>  sources to change the suexec docroot), php4 (4.3.10-16 from the
>  stable release and 4.4.2 from testing), and fastcgi (2.4.2 and i
>  tried the latest snap as well but i couldn't see any difference).
>  what i'd like to have: a separate user for each virtual host, php
>  under fastcgi&suexec, php using the owners uid/gid.
>  and the problems: i was playing with the configurations a lot (and
>  also tried fcgid but it didn't help much, it produced different
>  errors and noone had any idea about them), i've reinstalled
>  everything in connection with http several times, and so on. i've
>  also tried using the php interpreter straight from /usr/bin/php4-cgi
>  or copying
>  everything to the user's cgi-bin dir, but that wasn't the solution
>  either. what i
>  could achieve is that i have a working config on my home computer and
>  i have the same config on the server - where it produces a variety of
>  errors... (well, at the moment this sentence is not true - the config
>  WAS working on my home comp until i f*cked it up..).
>  /cgi-bin/php is the shell script you can see everywhere,
>  /usr/bin/php4-cgi is of course the normal php installation and
>  /cgi-bin/php4 is the same file copied to the cgi-dir.
>  so, if the config in my virtual host section points to the
>  shell script, and i load my testpage ( phpinfo(); in fact), than
>  i get the shell script printed out in the browser - wow, great.. so i
>  thought to point directly to the php4 file in my vhost config, and it
>  gives this error:
> Warning: Unexpected character in input: '' (ASCII=15) state=1 in /data/files/near.hu/public/cgi-bin/php4 on line 3023
> Parse error: parse error, unexpected '*' in /data/files/near.hu/public/cgi-bin/php4 on line 3023
> (don't forget, this if a simple phpinfo page). the line number wasn't
> always the same, but now it seems to be constant.
> well, i have spent lots of hours playing with all these things - now
> i'm begging you to give me at least a hint or any kind of help, 'cause
> i just don't have any more ideas. i can offer a beer for any good
> solution ( i can't guarantee it'll be served cold..)
> thank you very much in advance
> adam
> 
> /data/files/near.hu/public/cgi-bin/php:
> #!/bin/sh
> PHPRC="/etc/php4/near"
> export PHPRC
> PHP_FCGI_CHILDREN=4
> export PHP_FCGI_CHILDREN
> PHP_FCGI_MAX_REQUESTS=5000
> export PHP_FCGI_MAX_REQUESTS
> exec /usr/bin/php4-cgi
> 
> Vhost:
> ScriptAlias /cgi-bin/ /data/files/near.hu/public/cgi-bin/
> AddType application/x-httpd-fastphp .php
> Action application/x-httpd-fastphp /cgi-bin/php4
> SuexecUserGroup user group
> <Directory "/data/files/near.hu/public/cgi-bin">
>         AllowOverride None
>         Options ExecCGI -MultiViews +SymLinksIfOwnerMatch
>         Order allow,deny
>         Allow from all
> </Directory>
> 
> fastcgi.conf:
> <IfModule mod_fastcgi.c>
>   AddHandler fastcgi-script .fcgi
>   FastCgiWrapper /usr/lib/apache2/suexec2
>   FastCgiIpcDir /var/lib/apache2/fastcgi
>   FastCgiConfig -singleThreshold 100 -killInterval 300 -autoUpdate -idle-timeout 240 -pass-header Authorization
> </IfModule>
> <Location /cgi-bin/>
>   Options ExecCGI
>   SetHandler fastcgi-script
>  </Location> 
> 
> 
> 
> ------------------------------------------------------------------------
> 
> ___________________________________
> fastcgi-developers mailing list
> http://fastcgi.com/fastcgi-developers/

-- 
Michael Baierl
mbaierl.com   http://mbaierl.com/
- - - - - - - - - - - - - - - - -
Drag me, drop me, use me like an object.

___________________________________
fastcgi-developers mailing list
http://fastcgi.com/fastcgi-developers/