[Issue]
Under the current implementation of file permissions under Linux-based systems, it is possible for scripts to show the contents of files outside their home directory in a browser such as trying to use "cat /etc/passwd" and obtain a full listing of the system's users. This is not a security issue found only in PHP, but can be exploited by other scripting languages as well.
[Proposed workaround]
On a machine using DSO + mod_ruid2, the RDocumentChRoot directive allows the user's document root to be restricted to /home/$user/public_html location, which prevents calling files or directories out of that path. Since mod_ruid2 handles all processes run by Apache to that user, all scripting languages used on the user’s account would be restricted by mod_ruid2’s RDocumentChRoot setting (this is unlike mechanisms used only via PHP to restrict such access).
[Steps to install mod_ruid2 in cPanel 11.31+ versions]
1. Go to WHM > EasyApache (Apache Update) or run /usr/local/cpanel/scripts/easyapache in command line
2. Check Mod Ruid2 under Step 5's Short Options List
3. Select "Save and Build"
[Steps to add RDocumentChRoot for existing accounts]
All commands noted would be run in root SSH command line
1. Add the userdata include folders
2. Add the RDocumentChRoot directive for each existing user
3. Check all the includes are functioning
4. Update all users to add the includes into httpd.conf file
5. Restart Apache
[Steps to add RDocumentChRoot for new accounts]
All commands noted would be run in root SSH command line
1. Create the postwwwacct file
2. Add the following content to that file
3. Try creating a new account to check that /usr/local/apache/conf/userdata/std/2/username exists where username is the new cPanel account created.
[Important Notes]
The following were tested and still function upon restricting the user to /home/username/public_html
1. phpinfo pages and basic PHP scripts
2. Ruby on Rails
3. cPanel > Optimize Website (mod_deflate)
4. cPanel > Password Protect Directories
5. Apache's mod_userdir
The following were tested and no longer function upon restricting the user to /home/username/public_html
1. Listing directories outside the user's public_html such as "cat /etc/passwd" in any script
Test script to use:
It will display a blank page after enabling RDocumentChroot on the account. Previously, it would list the server’s /etc/passwd contents.
2. PHP's open_basedir
Enabling open_basedir in PHP will cause the following example type warnings on a page
Does not work as cgi-sys/defaultwebpage.cgi and img-sys are no longer in available paths to call
Other possible non-working components that were not yet tested
1. Tomcat
2. PHP's PEAR modules outside the user's public_html directory
Under the current implementation of file permissions under Linux-based systems, it is possible for scripts to show the contents of files outside their home directory in a browser such as trying to use "cat /etc/passwd" and obtain a full listing of the system's users. This is not a security issue found only in PHP, but can be exploited by other scripting languages as well.
[Proposed workaround]
On a machine using DSO + mod_ruid2, the RDocumentChRoot directive allows the user's document root to be restricted to /home/$user/public_html location, which prevents calling files or directories out of that path. Since mod_ruid2 handles all processes run by Apache to that user, all scripting languages used on the user’s account would be restricted by mod_ruid2’s RDocumentChRoot setting (this is unlike mechanisms used only via PHP to restrict such access).
[Steps to install mod_ruid2 in cPanel 11.31+ versions]
1. Go to WHM > EasyApache (Apache Update) or run /usr/local/cpanel/scripts/easyapache in command line
2. Check Mod Ruid2 under Step 5's Short Options List
3. Select "Save and Build"
[Steps to add RDocumentChRoot for existing accounts]
All commands noted would be run in root SSH command line
1. Add the userdata include folders
Code:
for i in `cat /etc/trueuserdomains | cut -d: -d' ' -f2-` ;do mkdir -p /usr/local/apache/conf/userdata/std/2/$i ;done
Code:
for i in `cat /etc/trueuserdomains | cut -d: -d' ' -f2-` ;do echo "RDocumentChRoot /home /$i/public_html" > /usr/local/apache/conf/userdata/std/2/$i/ruid2_chroot.conf ;done
Code:
/usr/local/cpanel/scripts/verify_vhost_includes
Code:
/usr/local/cpanel/scripts/ensure_vhost_includes --all-users
Code:
/etc/init.d/httpd restartAll commands noted would be run in root SSH command line
1. Create the postwwwacct file
Code:
touch /usr/local/cpanel/scripts/postwwwacct
chmod +x /usr/local/cpanel/scripts/postwwwacct
Code:
#!/usr/bin/perl
my %OPTS = @ARGV;
$ENV{USER} = "$OPTS{'user'}";
system q(mkdir /usr/local/apache/conf/userdata/std/2/$USER/);
system q(echo "RDocumentChRoot /home /$USER/public_html" > /usr/local/apache/conf/userdata/std/2/$USER/ruid2_chroot.conf);
system q(/scripts/ensure_vhost_includes --user=$USER);
system q(/etc/init.d/httpd restart);[Important Notes]
The following were tested and still function upon restricting the user to /home/username/public_html
1. phpinfo pages and basic PHP scripts
2. Ruby on Rails
3. cPanel > Optimize Website (mod_deflate)
4. cPanel > Password Protect Directories
5. Apache's mod_userdir
The following were tested and no longer function upon restricting the user to /home/username/public_html
1. Listing directories outside the user's public_html such as "cat /etc/passwd" in any script
Test script to use:
Code:
<?php
passthru( "cat /etc/passwd" );
?>2. PHP's open_basedir
Enabling open_basedir in PHP will cause the following example type warnings on a page
3. WHM > Web Template Editor > Default Website Page
Does not work as cgi-sys/defaultwebpage.cgi and img-sys are no longer in available paths to call
Other possible non-working components that were not yet tested
1. Tomcat
2. PHP's PEAR modules outside the user's public_html directory
