Re: advice request for shared hosting and security issue

On 23.06.13 14:48, Oğuz Yarımtepe wrote:
>I have a Debian Squeeze web server running PHP-FPM, fastcgi with apache2. I
>used dotdeb sources to install php-fpm and fastcgi. There are many vhosts
>defined on them, each has their own pool configuration and working without
>problems.
>
>My current problem is about the PhpSpy program. It is a PHP file that runs
>dir, chdir, readdir commands and let the user traverse the file system and
>read files. I couldn't figured it out a solution for it.
>
>I used chroot option at the pool configuration which didn't worked. It
>seems there is a but with Apache2 and Fastcgi usage. I enabled suexec also
>which didn't helped.
>
>I can try to disable opendir, chdir commands globally then some php files
>under vhost directories will be broken.
>
>What is the solution? Should i set chroot? If so how? Any working
>combination will be great for Debian Squeeze.
>
>I will be appreciated if there is an easier solution also.


I have tried to avoid something like this by using PHP compiled without
modules like posix,pcntl (maybe others?) and building special chroot that
only contained binaries of apache, php, used modules, and required
libraries.  It required small /dev (containing zero, null, urandom), small
/etc (containing stripped pasword, group and some others) and system with
/only a few libraries and directories.

It's doable but quite a pain to maintain.

other possibility is to use something similar to linux vservers with only
needed things built in.

-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
He who laughs last thinks slowest. 


-- 
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
Archive: http://lists.debian.org/[email protected]