Hi all Sorry to bother you, but this problem is getting really urgent for us (ISP). We are trying to setup PHP in a secure way but without restricting the users too much, and up to now we didn't come to an acceptable solution. We are running PHP 4.0.3pl1 with Apache 1.3.12 on a Linux/Suse6.4 platform, apache and php were installed directly from RPM archives, we didn't compile them ourselves. PHP is running as an apache module, and safe mode is turned on. Our main problem is, that no PHP script is able to write any file in the default setup, because safe mode doesn't allow PHP scripts to access any file which isn't owned by the same user the script also belongs to. Chowning the target directory to the apache user does not solve the problem, the write operation works but the written file can't be read anymore, because it has a different uid than all other PHP scripts, which were uploaded by the FTP user. Chowning everything to the webuser is no option, because we can't afford to do this for every single user wanting to write files additionally as soon as the FTP user updates his scripts the permissions are set to the FTP user again. Running PHP as a CGI binary also doesn't seem to be a good solution, as far as I can see it isn't possible to pass URL parameters in this setup, and this feature is already used. Disabling safe mode seems to be a very insecure option, because as far as I remember this would allow an FTP user to upload an executable and run it through PHP and thus access any file on the web server which is world-readable (please correct me if I'm wrong). What I really love to see would be a safe mode, which has the restriction of not allowing the PHP scripts to run executables (except in a specified directory) but without having the restriction of not beeing able to access any file not belonging to the FTP user (with the open_basedir variable, file access can anyway be restricted to the FTP users home directory). Is there any way to achieve this? It would also be nice if apache was able to run the PHP scripts with the userid of the FTP user, when PHP is configured as apache module. Can anyone tell me how to setup PHP in a secure way without getting these restrictions concerning file writing? Thank you very much for your feedback, and please CC your answer to [EMAIL PROTECTED]! Sam Jordan -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
