On Wednesday 28 September 2005 07:16, Julius Loman wrote: > On Wed, Sep 28, 2005 at 12:08:24AM -0700, Anthony Gorecki <[EMAIL PROTECTED]> wrote: > > On Tuesday, September 27, 2005 23:57, Julius Loman wrote: > > > For security reasons I want to have php scripts running > > > under file owner UID. > > > > PHP's "safe mode" might offer the security that you're looking for. > > I don't think so, at least files created by php scripts will be created > with UID that php is running. I don't want this, so do users.
This is indeed a serious issue and it deserves attention from careful sysadmins. On my previous sysadmin job, me and my team discussed this issue exactly. we were a team of sysadmins that (between many other things) handled a sun solaris server with about 8000 user accounts. I can't remember all the arguments, but: - suphp was abandoned due to poor testing and not supporting solaris well; - we didn't know fastcgi, but I assume it works by running php scripts through a shell interpreter called as a cgi. it's an option, and it doesn't require fastcgi... still it caused us trouble because the interpreter was being called with the apache owner. the suexec module has some limitations on this, since the php scripts didn't have .cgi extensions. our solution involved patching apache's suexec to handle .php scripts just like .cgi ones, running the interpreter on them. the guy who patched the suexec (and worked with me then) is on this list and I believe he'll give it to you, if it looks pretty enough. (CC'd him) as for performance, it surely dropped but we didn't really measure it with numbers. that wasn't really the main concern. regards, pedro venda. -- Pedro João Lopes Venda email: pjvenda < at > arrakis.dhis.org http://arrakis.dhis.org
pgpAsTUMT6xPq.pgp
Description: PGP signature
