1

I’m having trouble with PHP-FPM and Apache 2.4.1 mod_proxy_fcgi. As mod_proxy_fcgi cannot handle Unix Sockets, PHP-FPM has to listen on localhost. Thus, anyone who has access to the server could send requests to PHP-FPM. I wasn’t able to restrict PHP-FPM to my document root, so someone could just create a malicous PHP file, make sure my PHP process has access to it and send a special crafted request to the port on which PHP-FPM listens. (I already tried it out, it worked.)

I have the following in my apache config:

<VirtualHost *:80> ServerName example.org DocumentRoot /srv/vhosts/example.org/vhostdata/public/ <Directory /srv/vhosts/example.org/vhostdata/public/> Require all granted </Directory> <LocationMatch ^(.*\.php)$> ProxyPass fcgi://127.0.0.1:6001/srv/vhosts/example.org/vhostdata/public/ ProxyErrorOverride On </LocationMatch> </VirtualHost>

How do I make PHP-FPM prepent the document root /srv/vhosts/example.org/vhostdata/public/ on every request it receives? I already played around with the chdir directive, but it does not suitable for my needs.

Unfortunately, using a chroot is not an option for me because I am running in a linux-vserver enviroment, where mknod has been disabled by the administrator for security reasons.

Improve this question
3
  • You've really picked a whole bag full of inappropriate technologies there... Commented Mar 19, 2012 at 21:32
  • @womble: I’m starting to think so, too... so, what do you recommend? Using mod_fastcgi? Commented Mar 19, 2012 at 21:36
  • Yeah, mod_fastcgi has always worked for me. Getting out of the linux-vserver would be a winning strategy, too. Commented Mar 20, 2012 at 5:41

1 Answer 1

Reset to default
0

Running within a chroot is really your only option if you want to do this.

Do other people actually have access to run code on your machine? If so, I'd really suggest you switch to something that supports unix sockets, mod_fastcgi would be one option. The other option (if your app is compatible) is switching to nginx, which supports unix sockets for PHP.

If this is just worrying about security, I'd suggest you just tighten the permissions that PHP/Apache run as. If you can prevent malicious users from uploading files, you can prevent this exploit from ever occurring.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.