PHP configures open_basedir to let each virtual site run independently_PHP tutorial

A few years ago, I was complaining about the poor security of Apache running PHP. As long as one site was taken down, other sites on the server would suffer. At that time, I felt that this was really bad compared to IIS, because in IIS, you can set an anonymous account to use when accessing a site or even a directory in the security. As long as the accounts used by each site are different, the security between sites will be compromised. will not affect each other. Only in the past few days have I discovered that my idea at the time was wrong. Under Apache, you can also configure PHP to realize the independent operation of each site. Although you cannot control in detail how to run a site as a certain user, at least you will not be able to run it again. There is a situation where the entire server has been taken down.

This control can be achieved by configuring PHP's open_basedir. This configuration is also useful under IIS, but here we only talk about the configuration under Apache.

open_basedir can limit the user's activity scope of accessing files to a specified area, usually the path of his home directory.
The symbol "." can also be used to represent the current directory. open_basedir can also set up multiple directories at the same time, using semicolons to separate directories on Windows and
colons on any other system. When it acts on the Apache module, the open_basedir path in the parent directory is automatically inherited. The following takes the configuration under Linux system as an example

Method 1: Configure in php.ini
open_basedir = .:/tmp/

Method 2: Set
php_admin_value open_basedir .:/tmp/

in the VirtualHost configured by Apache

Method 3: Set
php_admin_value open_basedir .:/tmp/

in the Direcotry of Apache configuration

Explanation on the three configuration methods:
a. Method two has a higher priority than method one, which means that method two will override method one; method three has a higher priority than method two, which means that method two has a higher priority than method one. Three will cover method two;
b. "/tmp/" is added to the configuration directory because PHP's default temporary files (such as uploaded files, sessions, etc.) will be placed in this directory, so it is generally necessary to add this directory, otherwise Some functions will not be available;
c. "." added to the configuration directory refers to the current directory where the php file is run. This can avoid setting each site one by one;
d. If the site also uses a site directory For files other than other files, you need to set the directory separately in the corresponding VirtualHost;

After the settings are completed, remember to find a PHP web horse (such as: phpspy) to play with and test if there are any problems. If nothing else, the permissions should be quite well controlled. If you have any experience in PHP security configuration, please share it.

http://www.bkjia.com/PHPjc/364378.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/364378.htmlTechArticleA few years ago, I complained about the poor security of Apache running PHP. As long as a site was taken down, the server would be destroyed. Other sites on the website will suffer accordingly. At that time, I thought this was too...