Re: new security related directive for php-4.3.4

On March 19, 2004 04:46 pm, Rasmus Lerdorf wrote: > Ilia, come back to reality man! But it's so boring ;-). > Are you really suggesting that people use > Apache2 with the perchild MPM to solve this problem? If so, that's pretty > funny. I also fail to see how fastcgi solves the thousands of users on a > machine problem. It's not like fastcgi can switch back and forth either, > so you would need to run thousands of backend fastcgi php's all the time. Thousands of users on a single machines at least half (probably more) use dynamic scripts, would require some superb hardware and even then I very much doubt it could be done effectively. It would be far more practical and economical to have several cheaper servers with perhaps 100-300 (or less) users each. The bottom line that right now solutions do exist, Apache2 perchild MPM could work, so will Fastcgi. There are also things like mod_become, mod_suid and mod_diffprivs that can perform uid/gid changes for Apache1. http://www.jdimedia.nl/igmar/mod_suid/ http://www.snert.com/Software/mod_become/ http://sourceforge.net/projects/moddiffprivs/ Unlike with PHP implemented 'security' controls these are much less trivial to bypass. Ilia