PHP and UNIX

How do I secure my php config file?

[thunderpaste]

Hi, I am setting up on a new unix server and I dont know how to set up the permissions so I can run postnuke AND keep my php files secure.

Any help is greatly appreciated.

[dingman]

Hmm... I think you probably start by asking a mod to move this to either "PHP and Perl CGI Scripting" or "Linux, Unix, and *nix like Operating Systems", where it would likely get more attention from people who tend to do this sort of thing.

When setting file permissions for web-based applications in general, you need to make sure that:

1. The files are world-readable. Otherwise Apache won't serve them, even if Apache itself is allowed to read them.
   
2. If you are executing an external CGI script, it needs to be executable by the user Apache is running as. (Might need to be world-executable as well - I don't know for sure 'cause I rarely do this.) This one doesn't apply to scripts being executed by an Apache module.
   

Another oft-reccomended strategy for increasing security of a PHP script is to put the files you are referencing with include(), require(), and friends in a directory that Apache will not serve. They still need to be readable by Apache, but this way they will only get used when a PHP script calls them, never on their own. IE, if your home directory on the server is /home/me/ and you put your web site files in /home/me/public_html/, you can put included files that don't get served directly in /home/me/includes/.

That gives you two kinds of protection. The first is that since people often name their include files with an extention of '.inc' rather than '.php', the web server doesn't know to treat them as PHP if they are requested on their own. That means that your source code will get delivered to the user instead. That's probably not what you want, and will likely confuse a user who gets a bunch of PHP source code.

The second is that such include files are very likely to contain assumptions about things that will have been done before they are used. This works out just fine when you call them from your own scripts and those assumtions ar correct, but if someone requested one on its own and the server interpretted it as PHP you might get an error message or some partial completion of a larger process that could gum up the works for a long while.

Hope that helps.

[jatar_k]

as far as security goes, there are some interesting comments here

PHP Security [webmasterworld.com]