RE: [PHP] PHP/Apache security question

Does anyone know if SuExec plays "friendly" with PHP? From my recollection, when using suexec, it only alters the current UID/GID for scripts executed by httpd. Does PHP get treated the same way as would say a perl cgi script? I've looked a little at how phpwebhosting.com does it, and they set each user to their own unique primary group, and are (i believe) using suexec in their apache config setting each VirtualHost with their respective user and group... But does that really 'secure' everyone's code from other equally privileged users? :-? -- Aaron Bennett abennett@liquidstudio.com -----Original Message----- From: ..s.c.o.t.t.. [mailto:scott@furt.com] Sent: Saturday, July 07, 2001 4:33 PM To: Php-General Subject: RE: [PHP] PHP/Apache security question of course that's possible... it's not default, but it's very possible i think it's an apache module called suEXEC that will run the script with the script owner's name.group, not apache.apache > -----Original Message----- > From: lists@merlin.tech.intelinet.ro > Subject: [PHP] PHP/Apache security question > > Is there anything anyone can do about this? of course it would be ideal if > php would inherit uid/gid from the script file instead of the server > ownership but I think there is no way to accomplish this, so this is why > I am clueless. > > Oh, one more thingie: I have this CGI script here: > > #!/usr/bin/php > <html><head>..... > etc etc > ---------------- > > I try to access it and the "security warning!" page appears. The > documentation sais that it's ok to use such CGI scripts, and warns the > user about the security threat of using the php binary as a CGI. Obviously > I am not using the php binary as a CGI, rather I am creating a CGI script > that's interpreted using the php binary, so what seems to be the problem > here? > > Thx a lot, > georgeb > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net > -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net For additional commands, e-mail: php-general-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net