MRatWork Forum by Mustafa Ramadhan

Sawo Project - Kloxo-MR Discussions => Kloxo-MR Technical Helps => Topic started by: chrisf on 2013-12-30, 13:55:49

Title: suEXEC
Post by: chrisf on 2013-12-30, 13:55:49
I am wondering if KloxoMR uses suEXEC for cgi scripts?  Also wondering if CGI scripts can be run in any directory under /home/client/ or must it be /home/client/cgi?
Title: Re: suEXEC
Post by: MRatWork on 2013-12-30, 14:57:16
SuExec is specific for apache. It's 'old-fashion' for security (access docroot based on 'user').

No need for fastcgi (declare as 'php-fpm' in Kloxo-MR, suphp and mod_php_ruid2/itk).
Title: Re: suEXEC
Post by: chrisf on 2013-12-30, 17:14:41
My concern is a client uploading a perl or bash script that can overcome the basedir restrictions you just added to php-fpm.  How to protect from other scripting languages?
Title: Re: suEXEC
Post by: MRatWork on 2013-12-30, 17:21:50
Quote from: chrisf on 2013-12-30, 17:14:41
My concern is a client uploading a perl or bash script that can overcome the basedir restrictions you just added to php-fpm.  How to protect from other scripting languages?
Latest version of 6.5.0/6.5.1 already fix this issue (basedir issue).
Title: Re: suEXEC
Post by: chrisf on 2013-12-30, 19:45:45
Yes, I see in php-fpm template.  This is only for PHP, it doesn't protect other scripting languages.  Example would be perl.
Title: Re: suEXEC
Post by: MRatWork on 2013-12-31, 02:16:52
Suexec still exist in apache config. You can see something like '<IfModule suexec.c> SuexecUserGroup admin admin </IfModule>' inside apache domain config.
Title: Re: suEXEC
Post by: chrisf on 2014-01-01, 18:58:59
But doesn't there need to be a template, or it updated within each virtual host, or domain?

I am new to suEXEC and am confused slightly.  But from my reading it is a must in shared hosting to stop malicious scripts.

Please advise.
Title: Re: suEXEC
Post by: MRatWork on 2014-01-01, 20:03:25
Suexec already on in apache. You can see 'notice' in /var/log/httpd/error.log about suexec.