zoli do something about this also !

[naveed]

Hi zoli,

I really appreciate you to run such services.I am new to this community.And was just reading the post about "" PHP safe_mode ""

In my opinion you should not enable it on at least free accounts.
Thats just a suggestion , it depends on you. :)

In the meantime i have found some slight problem and i think i should point out it ,, even on the servers PHP is running under safe mode and phpinfo() is saying that socket functions are disabled

<a href='http://www.polarhome.com:793/~naveed/phpinfo.php' target='_blank'>http://www.polarhome.com:793/~naveed/phpinfo.php</a>

But i have noticed that some socket functions are still working , I think you should re-consider them .Because PHP is compiled with --enable-sockets.
And anyone can use them for malicious purposes ...

(Note:- dont think I m too among those spammers,only I am in hobby of testing things like this)

as an example take a look at this page ...

<a href='http://www.polarhome.com:793/~naveed/test.php' target='_blank'>http://www.polarhome.com:793/~naveed/test.php</a>


regards

naveed@php.net

[zoli]

hi,

seems you have a good connections with php.net.
If you help me to configure system that satisfies following requirements:
- php users run php with their UID/GID
- just shell users can have access to mail() and socket functions

than I will be happy to open polarhome with safe_mode=off etc.

[miker_alpha]

ATT: Zoli
Please note that (I think...) safe_mode has been left OFF on Alpha.Polarhome.com.

However, to make up for this CGI is not enables in users directories.
There was a thread about it <a href='http://www.polarhome.com/forum/index.php?showtopic=652&st=0&#entry4582' target='_blank'>here.</a>
(note esp. my posts of 30th June)

Of course I could be wrong about this!

MikeR

[naveed]

hi zoli,

As far as your first question that PHP should run under the user's UID/GID , yes it is possible.
For this to work you should have to install PHP as a CGI binary (compile with --enable-force-cgi-redirect),
it means that PHP will no longer run as Apache module.On high rate of hits this may slow down the speed.You may find its advantages/disadvantages at this url
<a href='http://www.php.net/manual/en/security.cgi-bin.php' target='_blank'>http://www.php.net/manual/en/security.cgi-bin.php</a>

Secondly you want to compile the apache with suExec enabled (if it is not already)

you can find how to compile apache with suExec option and its configuration settings here
<a href='http://httpd.apache.org/docs/suexec.html' target='_blank'>http://httpd.apache.org/docs/suexec.html</a>

Once apache is compiled with suExec wrapper you have to make some changes to your httpd.conf file,you have to change the Options directive as
Options MultiViews Indexes SymLinksIfOwnerMatch ExecCGI

The main thing about this is now all the PHP scripts should have executable permissions to work.
To avoid the downside of writing
#!/usr/bin/php
at top of each php script , I think you can avoid this by creating a sym link in your /cgi-bin/ directory of Apache .Make this link point to php binary installed in the system, and add the following lines in the httpd.conf files

AddHandler php4-script .php
Action php4-script /cgi-bin/php

A complete article article for configuraing Linux Debian in this way is available here
<a href='http://www.debianhowto.de/howtos/en/php_cgi/c_php_cgi.html' target='_blank'>Debian HowTo</a>

Now the resluting scripts will run under the requested user's UID/GID

Your second question is about disabling the mail and socket functions.
Unfortuantely there is no good way to do this neatly ( there are poor tricks which are also resource consuming).One suggestion is to make some changes in the source code and re-compile PHP for yourself ,since now PHP will run under UID of user you can consider what functions would be allowed to this user.Another one is to re-load different php.ini file for each user call so that each user can have different settings(this is worst).
Although I have not tested it anywhere but I hope this will work for at least mail() function.
That is change the sendmail_path in php.ini or httpd.conf and place some shell script which will check whether the caller has rights (means a shell user) and then direct it to the correct sendmail path, otherwise just to /dev/null etc..This way at least the user cannot send mails.

or let me give some time if i can put some better suggestion

[sjaz]

I think your inputs are very good and i thank you for helping.