PHP open_basedir security for multiple hosts

[rrinc]

Open_basedir is a PHP setting used to restrict filesystem access through PHP. It's useful to keep hosts on your server from accessing each other's files. Setting open_basedir in php.ini isn't very useful for virtual hosting since it is a single setting and each host will need to be restricted to a different folder.

To overcome this, when you setup PHP for each host you can add arguments to the PHP interpreter. For each host that you want to secure, set the arguments for the PHP interpreter to this and make sure to set the path to the documents directory for that particular host:

[AbyssUnderground]

I should let people know that this is not to be used to stop people hacking into your server through PHP. If you want to stop that you need to edit other php.ini settings besides the base directory. You also need to enable safe mode, edit the upload temp directory and disable other things that the user shouldn't need, including any functions you don't want them to use.

I had to do this because I was hacked through PHP and a virus was planted in my system files and was executed with PHP. Now I run safe mode on hosts that don't need the exec() or shell_exec() commands etc and it can no longer happen.

Just a heads up to anyone who thinks this is a full solution to hackers...
_________________
Andy (AbyssUnderground) (previously The Inquisitor)
www.abyssunderground.co.uk

[rrinc]

I agree it is not a full solution. Other settings can be added in a similar way without using ini's for each host. I would turn on safe mode in your php.ini then make exceptions for hosts that need it off by adding this:

[AbyssUnderground]