#16111 [Csd->Opn]: IIS + PHP CGI == special administrative concerns

ID: 16111 Updated by: philip@php.net -Summary: IIS/CGI only gives "Security Alert! PHP CGI cannot be accessed directly." Reported By: ramac10 at hotmail dot com -Status: Closed +Status: Open Bug Type: Documentation problem Operating System: Windows PHP Version: 4.2.1 New Comment: The issue of IIS permissions is related to this report but is difficult (at least for me) to come up with a straight forward comment on the issue. In doing some research it appears there are many factors that come into play here most of which fall under "IIS Administration". A few PHP related resources: http://www.iis-resources.com/modules/news/article.php?storyid=4 http://forums.devshed.com/archive/5/2002/10/3/45479 Basically the IIS user (usually IUSR_MACHINENAME) needs permission to read various files and directories, such as php.ini, docroot, and the session tmp directory... I don't feel comfortable documenting this without raising potential security issues (aka chmod 777 everything!!!) but will reopen for future comment. Maybe someone has a nice solution to this problem and actually knows the topic (I don't). Also some people have treated this report as a support forum, well, it's not. Do not ask support questions here. Previous Comments: ------------------------------------------------------------------------ [2003-05-12 11:48:36] bcecile at nemak dot com I was having the same problem, and the it was related to improper NT permissions. Please be sure that your IUSR_MACHINENAME has read permissions to the php.ini file. When I had this file in the c:\winnt folder, only Administrators and the System accounts had read access. This was fine while running PHP as an ISAPI module because IIS was loading the DLL using the System account, but once I switched to a CGI module, I started having problems. This was because IIS was now launching the exe file as IUSR_MACHINENAME which is did not have correct read access to the php.ini file. ------------------------------------------------------------------------ [2003-02-16 19:19:26] XpeditionPilot at hotmail dot com Some of the problems on this page I have fixed by making sure register gloabal variables is turned on in php.ini. Also an easy fix to the Security alert is to make sure php.ini has security set to everyone. Be sure only to change security for that file, not for the winnt or windows dir. Also make sure cgi.force_redirect is set to 0, as everyone has said. Good luck. ------------------------------------------------------------------------ [2003-01-20 01:16:36] philip@php.net This is now documented: http://cvs.php.net/cvs.php/phpdoc/en/chapters/install.iis.xml Thanks for the report :) ------------------------------------------------------------------------ [2003-01-19 23:50:43] sniper@php.net This is still a documentation problem, document that people should check their php.ini is actually read by PHP. ------------------------------------------------------------------------ [2003-01-18 15:17:01] philip@php.net This still looks like a problem to me, am marking as a PWS problem until resolved. Also it's important to know the correct php.ini is being edited as this seems to be the cause of many peoples problems. So before reporting information to this bug report, please be sure to state where phpinfo() says it is. If a PWS expert knows this is still a documentation problem, please reclassify with an explanation. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/16111 -- Edit this bug report at http://bugs.php.net/?id=16111&edit=1