Sophie: php-manual-en-4.3.0-2mdk noarch

php-manual-en-4.3.0-2mdk.noarch.rpm

<HTML
><HEAD
><TITLE
>Installed as an Apache module</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK
REL="HOME"
TITLE="PHP Manual"
HREF="index.html"><LINK
REL="UP"
TITLE="Security"
HREF="security.html"><LINK
REL="PREVIOUS"
TITLE="Installed as CGI binary"
HREF="security.cgi-bin.html"><LINK
REL="NEXT"
TITLE="Filesystem Security"
HREF="security.filesystem.html"><META
HTTP-EQUIV="Content-type"
CONTENT="text/html; charset=ISO-8859-1"></HEAD
><BODY
CLASS="sect1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>PHP Manual</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="security.cgi-bin.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
>Chapter 5. Security</TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="security.filesystem.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="sect1"
><H1
CLASS="sect1"
><A
NAME="security.apache"
></A
>Installed as an Apache module</H1
><P
>&#13;    When PHP is used as an Apache module it inherits Apache's user
    permissions (typically those of the "nobody" user). This has several
    impacts on security and authorization. For example, if you are using
    PHP to access a database, unless that database has built-in access
    control, you will have to make the database accessable to the
    "nobody" user. This means a malicious script could access and modify
    the database, even without a username and password. It's entirely
    possible that a web spider could stumble across a database
    administrator's web page, and drop all of your databases. You can
    protect against this with Apache authorization, or you can design
    your own access model using LDAP, .htaccess files, etc. and include
    that code as part of your PHP scripts.
   </P
><P
>&#13;    Often, once security is established to the point where the PHP user
    (in this case, the apache user) has very little risk attached to it,
    it is discovered that PHP is now prevented from writing any files
    to user directories. Or perhaps it has been prevented from accessing
    or changing databases. It has equally been secured from writing
    good and bad files, or entering good and bad database transactions.
   </P
><P
>&#13;    A frequent security mistake made at this point is to allow apache
    root permissions, or to escalate apache's abilitites in some other
    way.
   </P
><P
>&#13;    Escalating the Apache user's permissions to root is extremely
    dangerous and may compromise the entire system, so sudo'ing,
    chroot'ing, or otherwise running as root should not be considered by
    those who are not security professionals.
   </P
><P
>&#13;    There are some simpler solutions. By using
    <A
HREF="features.safe-mode.html#ini.open-basedir"
>open_basedir</A
> you can control and restrict what
    directories are allowed to be used for PHP. You can also set up
    apache-only areas, to restrict all web based activity to non-user,
    or non-system, files.
   </P
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="security.cgi-bin.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="security.filesystem.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Installed as CGI binary</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="security.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Filesystem Security</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>