PHP configures open_basedir to allow each virtual site to run independently_PHP tutorial

At that time, I felt that this was really bad compared to IIS, because in IIS, you can set an anonymous account to use when accessing a site or even a directory in the security. As long as the accounts used by each site are different, the security between sites will be compromised. will not affect each other. Only in the past few days have I discovered that my idea at the time was wrong. Under Apache, you can also configure PHP to realize the independent operation of each site. Although you cannot control in detail how to run a site as a certain user, at least you will not be able to run it again. There is a situation where the entire server has been taken down.

This control can be achieved by configuring PHP's open_basedir. This configuration is also useful under IIS, but here we only talk about the configuration under Apache.

open_basedir can limit the user's activity scope of accessing files to a specified area, usually the path of their home directory.
The symbol "." can also be used to represent the current directory. open_basedir can also set up multiple directories at the same time, using semicolons to separate directories on Windows and
colons on any other system. When it acts on the Apache module, the open_basedir path in the parent directory is automatically inherited. The following takes the configuration under the Linux system as an example

Method 1: Configure in php.ini
open_basedir = .:/tmp/

Method 2: Set in VirtualHost in Apache configuration
php_admin_value open_basedir .:/tmp/

Method three: Set
php_admin_value open_basedir .:/tmp/ in the Direcotry of Apache configuration.

Explanation of the three configuration methods:
a. Method two has a higher priority than method one, which means that method two will override method one; method three has a higher priority than method two, which means that method three will override method two;
b. "/tmp/" is added to the configuration directory because PHP's default temporary files (such as uploaded files, sessions, etc.) will be placed in this directory, so it is generally necessary to add this directory, otherwise some functions will not be available;
c, The "." added to the configuration directory refers to the current directory where the php file is run. This can avoid setting each site one by one;
d. If the site also uses files outside the site directory, it needs to be set separately in the corresponding VirtualHost. Directory;

After the settings are completed, remember to find a PHP web horse (such as: phpspy) to play with and test if there are any problems. If nothing else, the permissions should be quite well controlled.
If you have any experience in PHP security configuration, please share it.

http://www.bkjia.com/PHPjc/320852.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/320852.htmlTechArticleAt that time, I thought this was really bad compared to IIS, because in IIS, you can set it in security. The anonymous account used when accessing a site or even a directory, as long as each site uses...