EA4 and securing PHP processes

hicom

• September 21, 2016 07:47

Hi, Under EA3 we used to have PHP running as mod_ruid or SUPHP. Now that we've switched to EA4, we don't see mod_ruid anymore. Would running the CGI PHP be sufficient enough to prevent PHP scripts from escalating their privileges or do you have other recommendation for securing PHP/Apache under EA4? Thanks

• 

  hicom

  • September 23, 2016 21:38

  We are also confused with the new change in MultiPHP INI and how it works with EA4. If we want to have a "secure" PHP environment and allow our clients to specify PHP values for their own, what are the recommended values/modules for EA4? Thanks

  0
• 

  cPanelMichael

  • October 05, 2016 19:09

  Hello, Mod_Ruid2 is a default Apache module in EasyApache 4. However, it requires the DSO handler. The EasyApache 4 PHP packages include, but do not install, the DSO handler by default. To use the DSO handler, install the PHP package that you wish to use. For example, to install the PHP 5.6 package, run the following command:
  yum install ea-php56-php
  This is documented at: In addition, here's an example of entries you can add in the /etc/apache2/conf.d/includes/pre_main_global.conf file when using suPHP to lock the loaded PHP version to the server's php.ini for that version:
  suPHP_ConfigPath /opt/cpanel/ea-php54/root/etc/php.ini suPHP_ConfigPath /opt/cpanel/ea-php55/root/etc/php.ini suPHP_ConfigPath /opt/cpanel/ea-php56/root/etc/php.ini suPHP_ConfigPath /opt/cpanel/ea-php70/root/etc/php.ini suPHP_ConfigPath /opt/cpanel/ea-php71/root/etc/php.ini
  Thank you.

  0

Please sign in to leave a comment.