<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title>Installed as an Apache module</title>
</head>
<body><div class="manualnavbar" style="text-align: center;">
<div class="prev" style="text-align: left; float: left;"><a href="security.cgi-bin.shell.html">Case 4: PHP parser outside of web tree</a></div>
<div class="next" style="text-align: right; float: right;"><a href="security.filesystem.html">Filesystem Security</a></div>
<div class="up"><a href="security.html">Security</a></div>
<div class="home"><a href="index.html">PHP Manual</a></div>
</div><hr /><div id="security.apache" class="chapter">
<h1>Installed as an Apache module</h1>
<p class="simpara">
When <acronym title="PHP: Hypertext Preprocessor">PHP</acronym> is used as an Apache module it inherits Apache's user
permissions (typically those of the "nobody" user). This has several
impacts on security and authorization. For example, if you are using
<acronym title="PHP: Hypertext Preprocessor">PHP</acronym> to access a database, unless that database has built-in access
control, you will have to make the database accessible to the
"nobody" user. This means a malicious script could access and modify
the database, even without a username and password. It's entirely
possible that a web spider could stumble across a database
administrator's web page, and drop all of your databases. You can
protect against this with Apache authorization, or you can design
your own access model using LDAP, <var class="filename">.htaccess</var> files, etc. and include
that code as part of your <acronym title="PHP: Hypertext Preprocessor">PHP</acronym> scripts.
</p>
<p class="simpara">
Often, once security is established to the point where the <acronym title="PHP: Hypertext Preprocessor">PHP</acronym> user
(in this case, the apache user) has very little risk attached to it,
it is discovered that <acronym title="PHP: Hypertext Preprocessor">PHP</acronym> is now prevented from writing any files
to user directories. Or perhaps it has been prevented from accessing
or changing databases. It has equally been secured from writing
good and bad files, or entering good and bad database transactions.
</p>
<p class="simpara">
A frequent security mistake made at this point is to allow apache
root permissions, or to escalate apache's abilities in some other
way.
</p>
<p class="simpara">
Escalating the Apache user's permissions to root is extremely
dangerous and may compromise the entire system, so sudo'ing,
chroot'ing, or otherwise running as root should not be considered by
those who are not security professionals.
</p>
<p class="simpara">
There are some simpler solutions. By using
<a href="ini.core.html#ini.open-basedir" class="link">open_basedir</a> you can control and restrict what
directories are allowed to be used for <acronym title="PHP: Hypertext Preprocessor">PHP</acronym>. You can also set up
apache-only areas, to restrict all web based activity to non-user,
or non-system, files.
</p>
</div>
<hr /><div class="manualnavbar" style="text-align: center;">
<div class="prev" style="text-align: left; float: left;"><a href="security.cgi-bin.shell.html">Case 4: PHP parser outside of web tree</a></div>
<div class="next" style="text-align: right; float: right;"><a href="security.filesystem.html">Filesystem Security</a></div>
<div class="up"><a href="security.html">Security</a></div>
<div class="home"><a href="index.html">PHP Manual</a></div>
</div></body></html>
