The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

users access each others files

Discussion in 'Security' started by martin.henits, Apr 20, 2012.

  1. martin.henits

    martin.henits Member

    Joined:
    Aug 5, 2010
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    1
    Dear all,

    One question has been in my mind for a long time.

    Suppose that php is configured in DSO mode. Does this mean that user A can use a php script to access/modify a file that is created by user B's script?
     
  2. denny.j

    denny.j Member

    Joined:
    Apr 21, 2012
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Hi Martin,

    DSO option is usually the fastest way to execute PHP requests; this option uses the system user called “nobody” to serve all PHP requests.

    So, user A can modify / run a file owned by user B using the PHP scripts.

    I recommend running PHP either as suPHP or FastCGI
     
  3. cPanelTristan

    cPanelTristan Quality Assurance Analyst
    Staff Member

    Joined:
    Oct 2, 2010
    Messages:
    7,623
    Likes Received:
    21
    Trophy Points:
    38
    Location:
    somewhere over the rainbow
    cPanel Access Level:
    Root Administrator
  4. NetMantis

    NetMantis BANNED

    Joined:
    Apr 22, 2012
    Messages:
    117
    Likes Received:
    0
    Trophy Points:
    0
    Location:
    Utah
    cPanel Access Level:
    DataCenter Provider
    Yes, indeed they can!

    That is called "cross-site scripting" and it is one of many of the chief major problems running DSO based PHP!

    Actually, (and you would probably be happy to know this) the first part of that statement is not entirely accurate.

    Contrary to popular misconception, DSO is actually substantially slower than SuPHP when discussing raw speed performance but, at the same time, DSO also uses a lot less memory overhead than SuPHP which I think is what mainly confuses people.

    DSO's reduced memory consumption isn't enough to really justify it's use when you contrast that with all of the massive number of security problems plaguing DSO.

    DSO has just way too many problems and pitfalls to be safely used on any server.

    FCGI would be the best performance but it is only really useful under certain limited conditions and it is not one I would arbitrarily say to use with every server out there unless there was a real need to do so and the server had enough resources to take full advantage of FCGI.

    MOD_RUID2 is new and I've already identified a number of problematic issues with it and it also has it's own security and compatibility problem but at the same time does show some initial promise. I would not recommend it for production use at this time except for extremely resource limited servers such as lower end bottom of the line VPS servers but depending how this one evolves and is revised in updates and version releases, it does have the potential of later taking more of a center stage.
     
    #4 NetMantis, Apr 25, 2012
    Last edited: Apr 25, 2012
  5. cPanelTristan

    cPanelTristan Quality Assurance Analyst
    Staff Member

    Joined:
    Oct 2, 2010
    Messages:
    7,623
    Likes Received:
    21
    Trophy Points:
    38
    Location:
    somewhere over the rainbow
    cPanel Access Level:
    Root Administrator
    Have you utilized both DSO and suPHP on a heavily loaded machine with a large amount of traffic? Have you tried benchmark testing DSO versus suPHP on a machine? I ask as the speed difference due to the far lower CPU usage for DSO is substantial. Machines that switch from DSO to suPHP with a large amount of traffic and processes find that the load skyrockets. I'm just wondering where the information here is based (what tests have been done). I'd be happy to grab some discussions online and tests online to counter what is being stated, but I wanted to see where the information stems from first.
     
  6. hostnex

    hostnex Well-Known Member

    Joined:
    May 2, 2008
    Messages:
    77
    Likes Received:
    1
    Trophy Points:
    8
    Location:
    Islamabad, Pakistan, Pakistan
    cPanel Access Level:
    Root Administrator
    We like the idea of modruid2 with DSO but can we also control global php.ini like we were able to do in SUPHP. Also is it possible to allow any specific user to have its own php.ini.
     
  7. brianoz

    brianoz Well-Known Member

    Joined:
    Mar 13, 2004
    Messages:
    1,146
    Likes Received:
    6
    Trophy Points:
    38
    Location:
    Melbourne, Australia
    cPanel Access Level:
    Root Administrator
    Um. No. Sorry. Cross Site Scripting is something entirely different; probably worth you reading up on it.

    But yes, the ability to steal other people's passwords from config files, and create other mischief, is one reason why DSO is not a good choice for the average shared server.


    I'm sorry but this is also completely wrong. DSO is not slower under any circumstance. The speed issue with SuPHP is that it starts up a new process / binary for each request. This is thousands of times slower than DSO (for the process start up part, at least), as DSO runs PHP directly inside Apache - no startup time at all. You do see higher memory usage, of course, but I believe there are ways of mitigating that.

    The good news is that an average server doesn't notice the difference too much as it's not under enough pressure - regardless, the security cost of running DSO is just too high. The problem is that no matter how well you secure DSO (and there are some smart people out there doing a pretty good job of it) if someone escapes the file open restrictions they can steal database passwords etc - and most people running DSO don't know enough to secure the server.

    The problem is made worse by the Apache symlink issue which makes it possible for the same sort of password theft to occur under non-DSO as well if you haven't patched your server.
     
  8. srpurdy

    srpurdy Well-Known Member

    Joined:
    Jun 1, 2011
    Messages:
    101
    Likes Received:
    0
    Trophy Points:
    16
    cPanel Access Level:
    Root Administrator
    Like others have said. I don't know where you get this information.

    I'd also recommend not using DSO on memory restricted servers (even more so) Doesn't actually use less memory if anything it uses more memory.

    You end up with 100MB apache processes if you run a solid mod_security ruleset with DSO. Where if you have suPHP you only have 75MB processes, and suPHP kicks in when it has to which means you can have less memory "waste" Only situation that may change that configuration is if you have so much traffic that php is being pounded. In that case Mind as well use fast-cgi, and if memory is not enough well than you need more memory. :)


    Than again I'm someone that beleives if you don't run a solid mod_security ruleset you mind as well turn the server off. :)
    Shawn
     
    #8 srpurdy, May 3, 2012
    Last edited: May 3, 2012
Loading...

Share This Page