2

When one has an account on a shared server host running cPanel, the account runs in a jailed environment where access to files is restricted to /home/myaccount/ and its subdirectories.

However PHP runs as root, so is there any security issue possible where another (malicious) account-user could craft PHP scripts in such a manner as to access files in another users file area.

I have heard conflicting stories about this and would like a definitive answer from a "server guru".

Improve this question
0

1 Answer 1

Reset to default
2

PHP doesn't always run as root (and generally shouldn't). Many servers will use suPHP, "a tool for executing PHP scripts with the permissions of their owners". There's also PHP-FPM which allows you to "start workers with different uid/gid/chroot/environment and different php.ini".

Each hosting provider may use a different setup, so if you're concerned what they're using, just ask them. If they don't give you the answer you want, move along to the next host.

Improve this answer
3
  • I may not be a "server guru" per se, but hopefully that still answers the question.
    – Andrew Lott
    Commented Feb 3, 2016 at 11:58
  • It sounds like you are more a an expert on this than most! Also consider that PHP is an environment based language like Java and others. This allows the script to be isolated and not have direct access to the machine. How that manifests specifically for PHP, I am not entirely sure. However, traditionally, this model can be made relatively stable and secure over time. It seems that PHP is relatively stable and secure today. However, I have hobbled PHP and Java so that Apache websites cannot access these languages and environments at all while Apache still can. Just in case.
    – closetnoc
    Commented Feb 3, 2016 at 16:42
  • @Andrew thanks for the input, as U say a lot depends on how the server is setup, which is of course provider dependent. WHM has a lot of options and cPanel (the company) have lengthy docs on security. One of my clients is with a particular provider (I am trying to convince them to change providers) that does not even use https for cpanel access !!!! when challenged about that they said in 6 years they had not had an issue - it is not a matter of if they get compromised but merely a matter of when! That is the sort of thing one sometimes has to put up with :(
    – Jenn
    Commented Feb 3, 2016 at 23:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.