On Thu, Sep 28, 2006 at 12:52:41PM +0200, Joachim Schipper wrote:
> On Thu, Sep 28, 2006 at 10:55:30AM +0200, Aiko Barz wrote:
> > Hi *,
> >
> > I use OpenBSD+Apache+Chroot for my webservices. The users can access
> > their vhosts by using scponly, which is chrooted into /var/www as
> > well.
> > /htdocs/www.example.net belongs to theuser:www and has the
> > permissions rwxr-x---.
> >
> > The issue: If my users start to install a php-Filebrowser, they are
> > able to access the other Webdirectories and could read config.php,
> > because they are doing it with the permissions of the webserver.
> > Write access would be possible as well, since some parts need to have
> > write access.
> >
> > I started to patch suExec to make it handle *.php and to make it
> > chroot-ready, but I wasn't successful so far. suPHP seems to have
> > issues with 1.3.29 and ordering new IP-addressese for having multible
> > webserver intances seems to be difficult.
>
> As Henning pointed out, PHP's open_basedir and friends can be useful,
> although I would caution against believing they will actually work -
> suExec + PHP is not feasible for many people, due to the high webserver
> load incurred; suPHP may be less problematic, or not.
Replying to myself to add another thought...
It appears, from a quick web search, that FastCGI allows one to give
each user its own PHP instance.
One final thought: it would be better to use /virtual, as the Apache
docs recommend, to prevent a misconfiguration giving access to
everything in /htdocs. Or, at least, create a /htdocs/index.html.
Joachim
