0

I am using Crazy Domains to host my website. It is controlled by cpanel. It is a shared server (for now). I just realized that my login user (effectively root for my part of the server) is also the user that serves the web pages.

I have verified it by running this in a php script

  echo exec ('whoami'),"\n";
  echo posix_getpwuid(posix_geteuid())['name'];

I also created a file using this script on my website and the owner is the same as my login!

     $f = fopen ('test', 'w');
     fputs ($f, 'line');
     fclose ($f);

I had just assumed that they would have used different users for security. Am I correct in thinking this is an atrocious arrangement?

I don't yet know how I can change the user that the client employs. But, I am thinking of using a different group and user (with reduced access). I can't change the user they have given me for admin/root access as it happens to be my account name. But I can add new ones.

14
  • 5
    cPanel manages user security for you. When you run a script that executes a command line utility, that will run under the same user as the cPanel account, so I'd suggest not doing so. Scripts in general however should run under the Apache user setup by cPanel. If you'd like to harden that or your system, see: Tips to Make Your Server More Secure
    – dan
    Commented Aug 16, 2022 at 22:39
  • That script was from my admin webpage, not from the command line. But I have verified that the command line also uses the same user. Commented Aug 17, 2022 at 4:38
  • 1
    The script is using exec to execute the command line utility whoami, which is not the same thing as running from the command line. I think you're concerned about something you don't need to be if you avoid doing that - this is how cPanel is designed to work.
    – dan
    Commented Aug 17, 2022 at 14:31
  • 1
    So for the first part, you're seeking to confirm an inaccurate assumption by executing utilities and writing files with your user account. Apache usually runs under the "nobody" or "apache" user in cPanel however, and just serves files or calls interpreters like PHP to execute scripts and functions like exec or filesystem handling in the background under the user account (not the same account that Apache runs under). So there's really nothing to fix. If there was something majorly insecure about the way cPanel handles account security, it would have been fixed a long time ago.
    – dan
    Commented Aug 18, 2022 at 4:28
  • 1
    @dan - I have noticed that two folders are owned by nobody - public_html and .htpasswds Commented Aug 19, 2022 at 4:28

2 Answers 2

2

The account directory should look something like.

MyAcct
   > logs
   > www    <--- this is what is public.
   > cgi    <--- common CGIs that can be used but use private not public data.

or

MyAcct
   > logs
   > site1    <--- this is what is public.
   > site2    <--- public on different URL
   > cgi      <--- common CGIs that can be used but use private not public 
   > conf     <--- be nice if they gave you access.

PHP needs access to logs in order to provide them. The php.ini the gives access for php to access files in the MyAcct using something like. However, likely they are using another method because of breakout potential (see apache conf below), and shared hosting.

open_basedir = ".../MyAcct/

You may also want php to have access to other resources such as password information that you explicitly want not to have a public url (email, logs, etc) to keep it hidden from the internet at large.

MyAcct
   > logs
   > www    <--- this is what is public.
   > cgi 
   > private  <--- this data can be accessed by PHP.

The apache conf files have the means to set the base directory for php for any specific virtual host. But I suspect you are locked out, because you are on a shared host. But if they are not using it, they may have other means to secure accounts, so may have given you access in a conf folder?

<VirtualHost *:80>
        ServerAdmin [email protected]
        
        DocumentRoot /srv/web/domain.tld/htdocs
        ServerName domain.tld

        php_admin_value open_basedir /srv/web/domain.tld/:/usr/share/pear/
        php_admin_value upload_tmp_dir /srv/web/domain.tld/
        php_admin_value session.safe_path /srv/web/domain.tld/sessions/
        
        <Directory /srv/web/domain.tld/htdocs>
                php_admin_flag engine on
                AllowOverride AuthConfig FileInfo
                Order allow,deny
                allow from all
        </Directory>
</VirtualHost>

Note: changing the config files may require a restart of apache.

So for your clients you need to sell them a hosting package, which it appears is how crazy host is setup? Seems their affiliate offerings allows you to get a discount on selling clients their own account, which is a full account with their own cpanel. But I can not confirm.


Conclusion

The file security is at the account level. The FTP accounts created are not new accounts; Parked or added sites are not new account. The assistance of the person with actual root access may be required to make changes, but they may have automated it instead.

Specifically you need to change the apache conf file to block access from one domains php to another domains files. But you still need yours to access the (for lack of a better word) root of your account. To read your logs, email, et la.


A Virtual Machine

You could setup your own virtual machine. For reference were talking something like https://cloud.google.com/ or https://www.linode.com/ from a full virtual machine you get to have all the fun -- see all the fun at https://serverfault.com/search?q=share+web+hosting+file+security -- of setting up apache and php on your own machine, (yes the references have those available). You could also use other methods of jailing accounts into their own directories.

My interest in a virtual machine is not for shared hosting, (So I'm not the person who should try to secure it for a shared host environment where people I don't know can upload PHP accessible by the public), but installing things like ffmpeg so I can allow users of my site to upload video and then convert it for viewing. But, I'm not sure the time spent doing so would be worth the return.

2
  • I have ftp access and I had already looked at every folder (and file) above public_html. I don't have access to php.ini or httpd/apache conf files. My previous attempt at setting up a website was prototyping a now popular dating website some 12 years ago. On that shared server, I had clear and defined visibility about the html-user and my user accounts and I had to change the ownerships and permissions myself. I have no such visibility in this instance. I have prepaid for 10 yrs here. But I am looking at AWS now for my other 5 websites that are only paid for annually. Commented Aug 19, 2022 at 4:22
  • @RohitGupta AWS gives a full virtual machine; So you can do whatever you would like as far as how you want to set things up. If you want ffmpeg for video conversion no problem just pay for the CPU time. Commented Aug 19, 2022 at 19:06
1

I don't use CPANEL at all, however I have strong grasp of web servers and security arrangement.

Its not a fantastic arrangement, but its not atrocious either, and the impact depends on a lot of other factors as well.

If you are running your own server it is reasonable that the user who owns the files and the webserver are different - however this is often not practical - even on hosting that is reasonably secure. Many web applications expect to be able to write to filesystem (A common example is that Wordpress, by default, will allow people to upgrade plugins and Wordpress version once they are logged in at the web interface. You can modify this behaviour - for examples to force upgrades to use FTP, but by default WP expects the web user to have full write permissions).

If you host a single website this is likely a small concern. If you have multiple websites you may want each site to be owned by a different user with different apache perms (which I'm guessing will be the case here) and/or have only parts of the filesystem writable - especially jailing websites so that users can't use directory traversal or other mechanisms to browse unwanted parts of the filesystem or interact with other virtualhosts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.