Re: have anyone seen a working fastcgi/php isntallation..?

But you're forgetting one pretty important thing: exploitable scripts.
THE main problem we had is tracking down the script that has been used 
for an exploit.
If there's a "./ircd.cgi" running somewhere as www-data, there is no way 
you can track down where it came from. The same with spamruns because of 
badly developed mailforms.
We have FastCGI running and are pretty satisfied as it is "the best 
there is".

We have PHP4 running on FastCGI under FreeBSD. We had a lot of error 
500's, but with a errorhandler written in PHP we could somehow avoid the 
display of the error.

One problem we keep having is that some requests take over 30 seconds to 
complete. It looks like the FastCGI process is hanging.. We did receive 
some complaints about this, but since there is no better solution than 
the setup we have right now we'll stick with it. I'm curious if somebody 
else experiences the same problem :)
We cannot try Linux since the NFS & quota support aren't half as good as 
under FreeBSD...

All together we got it running pretty well for a couple of thousand 
websites...


----
Regards,
Ruben van der Zwan


Michael Baierl wrote:
> Hey there!
>
> Yeah, I had the same problem with PHP/FastCGI and I was not able to
> resolve it 'til now. So I reverted back to mod_php (because suphp is
> just tooo slow) and set it up in a bit more secure way:
> -) use safe_mode On
> -) use open_basedir for every vhost
> -) set upload_tmp_dir to a separate directory for each vhost
> -) set disable_functions to     
>     passthru,proc_close,proc_get_status,proc_nice,proc_open,
>     proc_terminate,shell_exec,apache_note,apache_setenv,closelog,
>     debugger_off,debugger_on,define_syslog_variables,openlog,
>     popen,pclose,syslog,wget,curl,puf
> -) disable PHP by default and enable it for every vhost that needs it
>
> With that approach all PHP scripts are executed as www-data, but the
> dangerous stuff is disabled and PHP can't break out of the directories
> defined in open_basedir. Theoretically. Practically it works perfect and
> I don't think someone can harm the system very easily.
>
> Best regards,
>
> Mike
>
> Divák Ádám wrote:
>> hello guys,
>>
>>  i still have the problem of setting up a secure&fast webspace - it
>>  seems to be much more difficult than i thought.
>>  so what i have: a debian system (maybe the only constant thing in
>>  this setup..), apache2 (tried with
>>  2.0.54-5 and 2.0.55-4, both custom-built from the original deb
>>  sources to change the suexec docroot), php4 (4.3.10-16 from the
>>  stable release and 4.4.2 from testing), and fastcgi (2.4.2 and i
>>  tried the latest snap as well but i couldn't see any difference).
>>  what i'd like to have: a separate user for each virtual host, php
>>  under fastcgi&suexec, php using the owners uid/gid.
>>  and the problems: i was playing with the configurations a lot (and
>>  also tried fcgid but it didn't help much, it produced different
>>  errors and noone had any idea about them), i've reinstalled
>>  everything in connection with http several times, and so on. i've
>>  also tried using the php interpreter straight from /usr/bin/php4-cgi
>>  or copying
>>  everything to the user's cgi-bin dir, but that wasn't the solution
>>  either. what i
>>  could achieve is that i have a working config on my home computer and
>>  i have the same config on the server - where it produces a variety of
>>  errors... (well, at the moment this sentence is not true - the config
>>  WAS working on my home comp until i f*cked it up..).
>>  /cgi-bin/php is the shell script you can see everywhere,
>>  /usr/bin/php4-cgi is of course the normal php installation and
>>  /cgi-bin/php4 is the same file copied to the cgi-dir.
>>  so, if the config in my virtual host section points to the
>>  shell script, and i load my testpage ( phpinfo(); in fact), than
>>  i get the shell script printed out in the browser - wow, great.. so i
>>  thought to point directly to the php4 file in my vhost config, and it
>>  gives this error:
>> Warning: Unexpected character in input: '' (ASCII=15) state=1 in 
>> /data/files/near.hu/public/cgi-bin/php4 on line 3023
>> Parse error: parse error, unexpected '*' in 
>> /data/files/near.hu/public/cgi-bin/php4 on line 3023
>> (don't forget, this if a simple phpinfo page). the line number wasn't
>> always the same, but now it seems to be constant.
>> well, i have spent lots of hours playing with all these things - now
>> i'm begging you to give me at least a hint or any kind of help, 'cause
>> i just don't have any more ideas. i can offer a beer for any good
>> solution ( i can't guarantee it'll be served cold..)
>> thank you very much in advance
>> adam
>>
>> /data/files/near.hu/public/cgi-bin/php:
>> #!/bin/sh
>> PHPRC="/etc/php4/near"
>> export PHPRC
>> PHP_FCGI_CHILDREN=4
>> export PHP_FCGI_CHILDREN
>> PHP_FCGI_MAX_REQUESTS=5000
>> export PHP_FCGI_MAX_REQUESTS
>> exec /usr/bin/php4-cgi
>>
>> Vhost:
>> ScriptAlias /cgi-bin/ /data/files/near.hu/public/cgi-bin/
>> AddType application/x-httpd-fastphp .php
>> Action application/x-httpd-fastphp /cgi-bin/php4
>> SuexecUserGroup user group
>> <Directory "/data/files/near.hu/public/cgi-bin">
>>         AllowOverride None
>>         Options ExecCGI -MultiViews +SymLinksIfOwnerMatch
>>         Order allow,deny
>>         Allow from all
>> </Directory>
>>
>> fastcgi.conf:
>> <IfModule mod_fastcgi.c>
>>   AddHandler fastcgi-script .fcgi
>>   FastCgiWrapper /usr/lib/apache2/suexec2
>>   FastCgiIpcDir /var/lib/apache2/fastcgi
>>   FastCgiConfig -singleThreshold 100 -killInterval 300 -autoUpdate 
>> -idle-timeout 240 -pass-header Authorization
>> </IfModule>
>> <Location /cgi-bin/>
>>   Options ExecCGI
>>   SetHandler fastcgi-script
>>  </Location>
>>
>>
>> ------------------------------------------------------------------------
>>
>> ___________________________________
>> fastcgi-developers mailing list
>> http://fastcgi.com/fastcgi-developers/
>
> ------------------------------------------------------------------------
>
> ___________________________________
> fastcgi-developers mailing list
> http://fastcgi.com/fastcgi-developers/
>

___________________________________
fastcgi-developers mailing list
http://fastcgi.com/fastcgi-developers/