CapÃtulo 25. InstalaciÃ³n como mÃ³dulo de Apache

Cuando PHP es usado como un mÃ³dulo de Apache, hereda los permisos del usuario de Apache (generalmente los del usuario "nobody"). Este hecho representa varios impactos sobre la seguridad y las autorizaciones. Por ejemplo, si estÃ¡ usando PHP para acceder a una base de datos, a menos que tal base de datos disponga de un control de acceso propio, usted tendrÃ¡ que hacer que la base de datos sea asequible por el usuario "nobody". Esto quiere decir que un script malicioso podrÃa tener acceso y modificar la base de datos, incluso sin un nombre de usuario y contraseÃ±a. Es completamente posible que un archivador automatizado de documentos web pudiera toparse con la pÃ¡gina web de administraciÃ³n de una base de datos, y eliminar todas sus bases de datos. Usted puede protegerse de este tipo de situaciones mediante mecanismos de autorizaciÃ³n de Apache, o puede diseÃ±ar su propio modelo de acceso usando LDAP, archivos .htaccess, etc. e incluir ese cÃ³digo como parte de sus scripts PHP.

Con frecuencia, una vez la seguridad se ha establecido en un punto en donde el usuario de PHP (en este caso, el usuario de apache) tiene asociada una muy leve capacidad de riesgo, se descubre que PHP se encuentra ahora imposibilitado de escribir archivos en los directorios de los usuarios. O quizÃ¡s se le haya desprovisto de la capacidad de acceder o modificar bases de datos. Se ha prevenido exitosamente que pudiera escribir tanto archivos buenos como malos, o que pudiera realizar transacciones buenas o malas en la base de datos.

Un error de seguridad cometido con frecuencia en este punto es darle permisos de administrador (root) a apache, o incrementar las habilidades del usuario de apache de alguna otra forma.

Escalar los permisos del usuario de Apache hasta el nivel de administrador es extremadamente peligroso y puede comprometer al sistema entero, asÃ que el uso de entornos sudo, chroot, o cualquier otro mecanismo que sea ejecutado como root no deberÃa ser una opciÃ³n viable para aquellos que no son profesionales en seguridad.

Existen otras soluciones mÃ¡s simples. Mediante el uso de open_basedir usted puede controlar y restringir aquellos directorios que podrÃan ser usados por PHP. TambiÃ©n puede definir Ã¡reas solo-Apache, para restringir todas las actividades basadas en web a archivos que no son de usuarios, o del sistema.

add a note User Contributed Notes
InstalaciÃ³n como mÃ³dulo de Apache

Kibab
30-Sep-2005 06:56


I'm running Windows version of Apache with php as module. System is Windows XP Service Pack 2 on NTFS filesystem. To avoid potential security problems, I've set Apache to run under NT AUTHORITY\Network Service account, and there is only one directory, named Content, with Full Access for this account. Other directories are either not accessible at all or with readonly permissions (like %systemroot%)... So, even if Apache will be broken, nothing would happen to entire system, because that account doesn't have admin privilegies :)

tifkap
01-Mar-2004 03:21


There is a safe way to support a lot of users in a secure way, without having to use CGI, in a way which is probebly faster

than mod_php.



Use FastCGI, with the SuExecWrapper set to your suid wrapper. It means every user wil get his own program-group, with processes

which are being reused. If the numer of processes that is being 

started on startup is 0, then the processgroup for a user will be generated when needed.



This means: The first page is slow, after that the Zend Engine  caching kicks in. When the load on the virtualhost reduces, the

processes wil die off, and extra processes for a user-process-group 

will only be started when (again) needed.



Your apache will be a LOT! lichter, because it won't have to drag all

the php-memory overhead with it. This means static content is 

faster, and the whole system uses less memory. 

The PHP itself also won't need to drag along the apache overhead.



If for one reason or the other php craches, your apache will simple 

start some new php-processes. If you want to upgrade/patch php, 

you can simple create the new fastcgi binary, and after testing, you can simple update the system by copying it, and maybe doing a 

'apachectl gracefull'



In short :  Sepparating distinct functions in different processes 

                communicating useing IPC methodes can be very good

                for performance and security. The best example of this

                principle at work is Postfix, where every process runs 

                chroot() under its own uid.



http://wiki.openisis.org/i/view/Php/HowtoFastCgi

Georgee at CWC
30-Apr-2003 06:16


Additional CAUTION to anyone trying Pollux's solution:

It's kind a good. Probably works right. I think I'll give it a try myself. BUT...

its safe ONLY on the assumption that apache is 100% CLEAN. (codes and confs.) Any flaws on apache, almost ANYTHING could happen to ALL users -precisely, web users. (Because apache is a member of ALL -again, web user's- GID.) So, leeps's hint should be one of the important things.



There is nothing close to perfect. What I wrote is just one thing you'll have to keep in mind. So, consider carefully BEFORE you try this solution. (Well, this applies to any other solutions though...)

leeps
10-Mar-2003 05:59


@pollux: additionally, tell your users to set their file-permissions to

- r-- (group) for files

- --x (group) for directories.



this disables the webserver to browse user's directory. if you don't know the filename, you cannot open it, e.g. by running malicious php-code through one of the users scripts.

daniel dot eckl at gmx dot de
08-Aug-2002 04:16


There is a better solution than starting every virtual host in a seperate instance, which is wasting ressources.



You can set open_basedir dynamically for every virtual host you have, so every PHP script on a virtual host is jailed to its document root.



Example:

<VirtualHost www.example.com>

  ServerName www.example.com

  DocumentRoot /www-home/example.com

[...]

  <Location />

    php_admin_value open_basedir     \ "/www-home/example.com/:/usr/lib/php/"

  </Location>

</VirtualHost>



If you set safe_mode on, then the script can only use binaries in given directories (make a special dir only with the binaries your customers may use).



Now no user of a virtual host can read/write/modify the data of another user on your machine.



Windseeker