Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

PHP might be running as a privileged group

Discussion in 'Security' started by rscalover, Dec 11, 2014.

  1. rscalover

    rscalover Member

    Joined:
    Dec 16, 2010
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    51
    Hello,

    this is what i get from phpsecinfo

    phperror.JPG

    Looking at value 10 that's the wheel group users in this group can use the "su -" command to get a root prompt.The error does not disappaer if u remove the user from the wheel group.That error is annoying anything i can do to make it disappaer ?.
     
    #1 rscalover, Dec 11, 2014
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,277
    Likes Received:
    1,846
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello :)

    Could you let us know which PHP handler (e.g. DSO, suPHP) is enabled on your system?

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 cPanelMichael, Dec 11, 2014
  3. rscalover

    rscalover Member

    Joined:
    Dec 16, 2010
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    51
    suPHP with suEXEC enabled i disabled fastcgi again because i whas getting allot of emails from csf about high resource usage.
     
    #3 rscalover, Dec 11, 2014
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,277
    Likes Received:
    1,846
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    You may want to post to the PHPSecInfo mailing list to report this issue to them or to have them better identify specific instances where it may not be an actual security problem.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #4 cPanelMichael, Dec 11, 2014
  5. quizknows

    quizknows Well-Known Member

    Joined:
    Oct 20, 2009
    Messages:
    1,010
    Likes Received:
    87
    Trophy Points:
    78
    cPanel Access Level:
    DataCenter Provider
    Was a user id that PHP runs as in the wheel group? If so that's not a good sign IMO, unless you were running the site under an account that you had knowingly granted that privilege to.

    Also how are you accessing phpsecinfo? Under what user or document root are you calling it? I tried it under a SuPHP user with SuEXEC and I do not get the privileged GID warning.
     
    #5 quizknows, Dec 11, 2014
    Last edited: Dec 11, 2014
  6. rscalover

    rscalover Member

    Joined:
    Dec 16, 2010
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    51
    I granted that permission (the wheel group thing) i call phpsecinfo like this domain.com/phpsecinfo/index.php the strange thing is the warning does not disappaer if i remove the involved user from the wheel group also i don't get a warning about the user running PHP.If it works with no warning on your end then there must be something wrong on my end i will find out i think CloudLinux (CageFS and such) have something todo with it.

    I just noticed the index.php file is just an example howto call that system jeesus sorry for being ignorant about this

    my suphp_log shows the correct UID and GID values

     
    #6 rscalover, Dec 12, 2014
    Last edited: Dec 12, 2014
  7. rscalover

    rscalover Member

    Joined:
    Dec 16, 2010
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    51
    Hello,

    When i disable CageFs for that particular account the error disappaers

    php_error_gone.JPG


    now the question is why is this happening ? i guess i need to ask cloudlinux support.
     
    #7 rscalover, Dec 12, 2014
  8. rscalover

    rscalover Member

    Joined:
    Dec 16, 2010
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    51
    hi,

    Problem solved :D after i removed the involved user from the wheel group using the usermod command it whas still saying that user is a member of the wheel group.I scratched my head and turns out CageFs has it's own group and passwd files and you need to edit them (only group file in this case) after that you need to run as root

    just posting in case anybody has the same problem.
     
    #8 rscalover, Dec 14, 2014
  9. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,277
    Likes Received:
    1,846
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    I am happy to see you were able to address the issue. Thank you for updating us with the outcome.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #9 cPanelMichael, Dec 15, 2014
(You must log in or sign up to post here.)
Loading...
Similar Threads - might running privileged
  1. rk4n3

    What operations might clear out cPHulk whitelist and blacklist ?

    rk4n3, Feb 13, 2018, in forum: Security
    Replies:
    3
    Views:
    196
    cPanelMichael
    Feb 16, 2018
  2. Volt55

    Is this website running php7.2?

    Volt55, Jul 30, 2018, in forum: EasyApache
    Replies:
    1
    Views:
    48
    cPanelMichael
    Jul 31, 2018
  3. Anouchka Minkoue Obame

    A Licence Check Appears to Already Be Running

    Anouchka Minkoue Obame, Jul 30, 2018, in forum: General Discussion
    Replies:
    2
    Views:
    43
    cPanelLauren
    Jul 31, 2018
  4. knightmare

    About running port

    knightmare, Jul 9, 2018, in forum: General Discussion
    Replies:
    3
    Views:
    92
    cPanelLauren
    Jul 10, 2018
  5. David Newall

    Detected PID 1 running outdated executable

    David Newall, May 21, 2018, in forum: General Discussion
    Replies:
    3
    Views:
    100
    cPanelLauren
    May 22, 2018

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice