security problem with php5_cgi=yes

[tincboy]

I've recompiled php with php5_cgi=yes
But with a simple shell script I can see whole server's files,
Doesn't php5_cgi means each file must have it's owner and permissions right?

 

[ditto]

Try enabling SAG http://www.directadmin.com/features.php?id=961 - this is now the default for all new DA installations.

 

[zEitEr]

With SAG you won't forbid users to go out of homedir and read system files. It will protect from seeing other users homedirs.

 

[tincboy]

So you are saying php5_cgi is not secure enought by it's own?

 

[zEitEr]

Login as a general user via SSH and see where you can get with your permissions. Why do you think PHP makes any big difference? Of course you might want to use open_basedir (if you are not using 5.3.x), but it won't give 100% guarantee.

 

[tincboy]

I asked that because while I was using php_cli=yes that specific shell can't see other files out side of it's home directory, but changing it to php5_cgi made this issue,
Previously I guessed running php_cgi is more secure than cli, isn't it right?

 

[zEitEr]

Yes, PHP_CGI is more secure, in my opinion. Despite on that, you should take care of security of your server, and chmod/chown your directories and files extra if it's needed.

 

[tincboy]

Permissions are right, but the shell can access other user's files,
I guess something is wrong in my server and php_cgi is not really working, How can I sure that php files are running with relate user's permission and not by apache or nobody users?

 

[zEitEr]

See output of

<?php
var_dump(exec('id'));
?>

Make sure exec() is allowed in your PHP.INI.

 

[tincboy]

it shows that the file is running with related user and not by apache or nobody,
Do you have any guess what's wrong that a user can see other's file while using php_cgi ?

 

[zEitEr]

Use SAG, as it was already suggested above to prevent users from seeing in each other's public_html folders.

Use open_basedir with PHP 5.2.x

PHP_CGI does not give you the protection, and it does not keep users from seeing other's files. Set strict permissions in ssh, if you need to keep any file from others.