The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Files Owned by nobody and Disk Usage!

Discussion in 'General Discussion' started by IdleServ, Sep 29, 2005.

  1. IdleServ

    IdleServ Active Member

    Joined:
    Oct 27, 2003
    Messages:
    35
    Likes Received:
    0
    Trophy Points:
    6
    Is cPanel going to try do something about checking what is physically in a users account space rather than just search for files owned by the user to calculate total disk space?

    I've just discovered an account using over 14GB of disk space with attachments uploaded via their forums.

    This is not the 1st time.

    Users are getting away with being able to exceed disk space limits because files are owned by nobody due to PHP uploads.
     
  2. aby

    aby Well-Known Member

    Joined:
    May 31, 2005
    Messages:
    638
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    India
    You can disable the option upload using php in php.ini
     
  3. brianoz

    brianoz Well-Known Member

    Joined:
    Mar 13, 2004
    Messages:
    1,146
    Likes Received:
    6
    Trophy Points:
    38
    Location:
    Melbourne, Australia
    cPanel Access Level:
    Root Administrator
    A fairly simple solution is to write a script that goes through home directories, chowning the nobody files to each user account, then they're included in the disk quota. Or, switch to using phpsuexec/suexec.
     
  4. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    Indeed. One of several reasons I always have phpsuexec enabled on all of my own servers. Ultimately, it's an issue between php and apache and the poor way that php has been developed for the real world and there's little cPanel can do about it.
     
  5. brianoz

    brianoz Well-Known Member

    Joined:
    Mar 13, 2004
    Messages:
    1,146
    Likes Received:
    6
    Trophy Points:
    38
    Location:
    Melbourne, Australia
    cPanel Access Level:
    Root Administrator
    Of course, one of the reasons it's switched on in my servers is because you administer them :)

    (I hate to give away one of my secrets ;) )
     
  6. IdleServ

    IdleServ Active Member

    Joined:
    Oct 27, 2003
    Messages:
    35
    Likes Received:
    0
    Trophy Points:
    6
    Disabling uploads and chowning files isn't an option as that will cause problems with user's scripts.

    Reason for chowning files being bad is because the script will then not have access to delete the uploaded file. It would be a headache to get the user to understand about permissions and chmod'ing, etc... especially if they are just newbies using a 3rd party script.

    Just wish cPanel could modify their script to look at whats physically in a user's homedir.
     
  7. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    Since cPanel are using standard unix file ownerships, they can't for the reasons I mentioned.
     
  8. carock

    carock Well-Known Member

    Joined:
    Sep 25, 2002
    Messages:
    232
    Likes Received:
    1
    Trophy Points:
    18
    Location:
    St. Charles, MO
    Since PHP created the files as user nobody, wouldn't PHP also be able to chown them to another user?

    If so, does someone have a utility script that can be run to facilitate the changing of ownership of these files?

    I know this is an old thread, but I didn't want to start a new one for the same problem.

    Thanks,
    Chuck
     
  9. sparek-3

    sparek-3 Well-Known Member

    Joined:
    Aug 10, 2002
    Messages:
    1,384
    Likes Received:
    23
    Trophy Points:
    38
    cPanel Access Level:
    Root Administrator
    PHP created the files as nobody because that is the user that was running the Apache process that wrote the files. It doesn't have signficant privileges to change the ownership.

    As chirpy stated this is just an issue between PHP and Apache. I'm not sure which side is to blame or really if any side is to really blame. This is just the way it works. Apache runs as nobody, PHP scripts run as nobody, files written by PHP as owned by nobody.

    From a security point of view, if you are going to have PHP scripts that upload and/or create files, then PHP needs to be run as CGI or in some way, run the PHP script as the account owner. Having files owned by nobody and having open directories that are required for PHP scripts to write files as nobody can be a security risk.

    Running PHP as CGI (FastCGI, phpsuexec, suPHP, etc) may result in a slight performance loss, but its either that or having insecurities on the server. Take your choice.
     
Loading...

Share This Page