Php – Should I use suPHP or DSO (mod_PHP) when php scripts need to manipulate files

apache-2.2file-permissionspermissionsPHPSecurity

I recently asked a question on StackOverflow and I'm going to re-ask it here as a different question and with some changes and additional information.

I have a bunch of php scripts that need the ability to create, move, and delete files and folders. The scripts also need to move and delete files that have been uploaded via FTP from a Windows machine.

My VPS currently uses DSO, so in order for my scrips to execute and not die with permission errors I've been having to CHMOD all directories and files to 777.

From what I've read, using 777 permissions is insecure and should not be done. I have a VPS, but there are multiple users as I host a number of websites, some of which other people are in control of.

I it may be relevant for me to mention that I ran phpinfo() and found the following under the section "PHP Credits":

User/Group      nobody(99)/99

I've been doing reading on the subject of file manipulation via php and suPHP vs. DSO, but I'm still unsure of what I should be doing. From what I've read, it seems like switching to suPHP would fix all my problems (no more problems with permissions), but I've read that it dramatically slows down the server.

Could anyone give me any advice on this matter?

Best Answer

From what I've read, it seems like switching to suPHP would fix all my problems (no more problems with permissions)

Yes, suPHP will solve all permissions related problems provided you do not have anything CHMOD 0777 - suPHP will reject this as a giant security hole and fill your error_log with messages telling you to change it to 0755 at most.

The best way to think of it is this:

  • No suPHP = PHP runs as a "general" user, rather like if you had a domestic helper. You ask the domestic helper to fetch you things then they will, but if you ask them to do things that specifically require you (sign a contract -> write to a file) then they won't be able to.
  • suPHP allows you to have as many domestic helpers as you like, but they all pretend to be you. They can do everything you can do, no more, no less. No problems!

I've read that it dramatically slows down the server.

Where? I have never known this to be a problem, at all.

In summary: switch to suPHP.

Related Topic