Paid Advertising is
ha.ckers sla.cking
Who's got it? Who's giving it away? How to protect your privacy and steal it from other people. For intellectual privacy, personal privacy, and blackhats alike... 
Go to Topic: PreviousNext
Go to: Forum ListMessage ListNew TopicSearchLog In
PHP + chroot
Posted by: nexz
Date: April 28, 2008 03:16PM

First, I believe PHP is not secure. Well, PHP code base might be secure but since it is a glue, other 3rd party libraries it uses may not. So I thought I'll use
chroot to stop the impact in case break-in occurs. Now, I have the following options:

1) Chroot'ing entire Apache tree including PHP and everything. In this case, all chroot'ed processes (Apache and the ones it invokes) will be running as non-root one same user
2) Apache will be run as root but PHP will run as fastCGIDaemon. In this case, Apache won't be chroot'ed and that PHP CGI daemon will be chroot'ed under dedicated user

Now I have the following problems:

Related to #1:
Chroot'ing entire web architecture (Apache, its gang, and future stuffs like databases, etc.) involves huge amount of work and maintenance nightmare. Plus,
if any one of those mandates to be run as root, it will render the whole thing useless. I don't see much potential following this route beyond a certain point.

Related to #2:
I read somewhere that PHP behavior changes somewhat IF you run it as fast CGI daemon instead of being built into the Apache as module. Now, since it behaves a
little differently, some of the 3rd party libraries might break. Has anyone tried this or am I thinking it right?

Any suggestion or comments are welcome.

In the end, my real question is how would you secure PHP based website, with or without using chroot?


Options: ReplyQuote
Re: PHP + chroot
Posted by: id
Date: April 28, 2008 04:05PM

Chroot isn't a security measure, if you are running freeBSD try a jail, it is chroot, but has security features, and if done properly isn't much work at all.

And there is no reason at all to ever run Apache as root.


Options: ReplyQuote
Re: PHP + chroot
Posted by: Om
Date: April 29, 2008 01:42AM

You might also want to have a look at SELinux.

I'd love to change the world,
but they won't gimme the source code.
Code in my Bug!

Options: ReplyQuote
Re: PHP + chroot
Posted by: Malkav
Date: April 29, 2008 11:13PM

SELinux is not in ANY WAY recommendable. it is far too heavy and unusable for its benefit. PaX + Grsecurity is the way to go under linux. with a properly configured RBAC and a well managed, well audited box, you're pretty much in the clear.
else an hardened freebsd is *way* harder than a hardened linux. of course it implies a little patching with diffs from OpenBSD, but the benefits are really great.


Those that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety.
--Benjamin Franklin

Options: ReplyQuote

Sorry, only registered users may post in this forum.