issue with no admin user allocated

Discussion in 'General' started by djtremors, Sep 12, 2006.

  1. djtremors

    djtremors ISPConfig Developer ISPConfig Developer

    Hey all,

    Just noticed an issue where I have a user as an admin and files on their home path is 644 but I noticed that when I remove the admin rights to the ispc system for that site, all files belong to "apache" user now.

    This opens the server up for writing now and any content can be changed if there is a vulnerable page whereas as the user they can't modify the files with the 644 permissions.

    PHP:
    drwxrwxr-x   2 apache web7 4096 Jul 21 10:32 cgi-bin
    drwxr
    -xr-x   3 apache web7 4096 Sep  5 09:58 log
    drwxrwxrwx   2 apache web7 4096 Sep 12 12
    :13 phptmp
    drwxr
    -xr-x   2 apache web7 4096 Jul 21 10:32 ssl
    drwxr
    -xr-x  11 apache web7 4096 Sep  8 21:24 user
    drwxrwxr
    -x  17 apache web7 4096 Sep 12 15:25 web
    anyone notice this?
     
  2. falko

    falko Super Moderator ISPConfig Developer

    That's the expected behaviour because we need some user to allocate the pages to if there's no site admin, and we chose the Apache user for it. Of course, you should have a site admin, and you shouldn't give shell access to your users, and use PHP Safe Mode if possible.
     
  3. djtremors

    djtremors ISPConfig Developer ISPConfig Developer

    So you think making it the apache user is the best idea? Why not root or some huge number ie. 87726876534 so that no one can write to any of the files?

    Where can I change this as it's a security issue for me?
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    This is all setup in the file /root/ispconfig/scripts/lib/config.lib.php.
     
  5. till

    till Super Moderator Staff Member ISPConfig Developer

    It is not an issue if you either use SuPHP, SueEXEC or use Safemode in PHP which is always recommended.
     
  6. djtremors

    djtremors ISPConfig Developer ISPConfig Developer

    I can't get suphp or suexec working right now and it doesn't seem like a right reason to turn it on anyway. php safemode only tells apache to force executing scripts to work only with the same uid which it's still apache and writable too. Not only that it breaks CMS sites like Joomla and

    I'll modify the config.lib.php file.
     
  7. till

    till Super Moderator Staff Member ISPConfig Developer

    ISPConfig enables open basedir restrictions in PHP if you enable the php safemode checkbox, so noone will be able to read other directories as long as there are no security vulnerabilities in PHP :)
     
  8. djtremors

    djtremors ISPConfig Developer ISPConfig Developer

    safemode is pointless if the files are owned by the apache server user. Website can write to any file because it owns them.
    I've change it to hard code to "root" so nothing (even the website) can write to the files unless they are chmod 777 already.
     
  9. till

    till Super Moderator Staff Member ISPConfig Developer

    Thats not correct for ISPConfig, have you tried it? The ISPCOnfig safemode checkbx does not only configure the PHP safemode, it also sets a directory restriction which prevents PHP scripts to read or write any file outside of the web directory.
     

Share This Page