Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

EA4 and securing PHP processes

Discussion in 'EasyApache' started by hicom, Sep 21, 2016.

Tags:
  1. hicom

    hicom Well-Known Member

    Joined:
    May 23, 2003
    Messages:
    279
    Likes Received:
    2
    Trophy Points:
    168
    Hi,

    Under EA3 we used to have PHP running as mod_ruid or SUPHP. Now that we've switched to EA4, we don't see mod_ruid anymore.

    Would running the CGI PHP be sufficient enough to prevent PHP scripts from escalating their privileges or do you have other recommendation for securing PHP/Apache under EA4?

    Thanks
     
    #1 hicom, Sep 21, 2016
  2. hicom

    hicom Well-Known Member

    Joined:
    May 23, 2003
    Messages:
    279
    Likes Received:
    2
    Trophy Points:
    168
    We are also confused with the new change in MultiPHP INI and how it works with EA4.

    If we want to have a "secure" PHP environment and allow our clients to specify PHP values for their own, what are the recommended values/modules for EA4?

    Thanks
     
    #2 hicom, Sep 23, 2016
  3. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    42,802
    Likes Received:
    1,714
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    Mod_Ruid2 is a default Apache module in EasyApache 4. However, it requires the DSO handler. The EasyApache 4 PHP packages include, but do not install, the DSO handler by default. To use the DSO handler, install the PHP package that you wish to use. For example, to install the PHP 5.6 package, run the following command:

    Code:
    yum install ea-php56-php
    This is documented at:

    PHP Handlers - EasyApache 4 - cPanel Documentation

    Information on php.ini files with EasyApache 4 is available at:

    The cPanel PHPRC PHP Patch for EasyApache 4 - EasyApache 4 - cPanel Documentation

    In addition, here's an example of entries you can add in the /etc/apache2/conf.d/includes/pre_main_global.conf file when using suPHP to lock the loaded PHP version to the server's php.ini for that version:

    Code:
    <IfModule mod_suphp.c>
<Location />
suPHP_ConfigPath /opt/cpanel/ea-php54/root/etc/php.ini
suPHP_ConfigPath /opt/cpanel/ea-php55/root/etc/php.ini
suPHP_ConfigPath /opt/cpanel/ea-php56/root/etc/php.ini
suPHP_ConfigPath /opt/cpanel/ea-php70/root/etc/php.ini
suPHP_ConfigPath /opt/cpanel/ea-php71/root/etc/php.ini
</Location>
</IfModule>
    Thank you.
     
    #3 cPanelMichael, Oct 5, 2016
(You must log in or sign up to post here.)
Loading...
Similar Threads - securing processes
  1. tdot

    Securing Server

    tdot, Nov 2, 2017, in forum: Security
    Replies:
    1
    Views:
    201
    cPanelMichael
    Nov 2, 2017
  2. lukapaunovic

    Securing server without CloudLinux question

    lukapaunovic, Aug 19, 2017, in forum: Security
    Replies:
    6
    Views:
    448
    cPanelMichael
    Aug 22, 2017
  3. jazee

    Securing WHM (and SSH)

    jazee, Jul 2, 2017, in forum: Security
    Replies:
    2
    Views:
    891
    cPanelMichael
    Jul 3, 2017
  4. Spork Schivago

    Help securing rpcbind

    Spork Schivago, Jun 14, 2017, in forum: Security
    Replies:
    4
    Views:
    848
    Spork Schivago
    Jun 14, 2017
  5. Travis Owens

    Securing Ports 2082 and 2086 (SSL)

    Travis Owens, Mar 30, 2017, in forum: Data Protection
    Replies:
    1
    Views:
    605
    cPanelMichael
    Mar 30, 2017

Share This Page