suPHP mailing list

Pekka Jalonen | 15 Feb 2011 00:19

Picon

Picon

suPHP in Debian (lenny / squueze)

Hello,

Is this bug or feature in suPHP?

I am running suPHP in Debian (lenny and squeeze).

In lenny I can run following php without problems (version 0.6.2-3)
" system('id'); "

It's print out on browser without problems.
" uid=1000(peja) gid=100(users) groups=100(users) "

But in squeeze (version 0.7.1-1)

" system('id'); "  is not working (blank browser page) and I have to
change it following.

" system('/usr/bin/id'); "

Yes, there is also in suphp.conf

;PATH environment variable
env_path=/bin:/usr/bin

When I change it and restart apache no effect.

Well is there problem in php/suphp conf or where?

Thanks,
--

--

(Continue reading)

Pekka Jalonen | 16 Feb 2011 22:12

Picon

Picon

Re: suPHP in Debian (lenny / squueze)

Hello,

> ;PATH environment variable
> env_path=/bin:/usr/bin

... in Debian squeeze (6.0) must be
env_path=/bin\:/usr/bin

Then it's working at Debian squeeze (6.0).

Thanks.

Regards,

--

-- 
Pekka Jalonen | http://www.iki.fi/pekka.jalonen | http://jalonen.net
"Sometimes the truth hurts. And sometimes it feels real good."

Sebestyén Dénes | 18 Feb 2011 12:17

Picon

suPHP vs. Squeeze

Hi

I had a problem with suPHP after upgrading to Squeeze. I managed to 
solve the problem, maybe I can help somes.

After the upgrade the suPHP-ed sites on my server wrote 
permission-related error messages.
I found that the no suPHP logs were created after the upgrade, so I 
started to find the answer why.

Solution:
In the previous versions, the php5.conf apache configuration file had 
something like this:
     AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml

After the upgrade. it changed to this:
<FilesMatch "\.ph(p3?|tml)$">
     SetHandler application/x-httpd-php
</FilesMatch>
<FilesMatch "\.phps$">
     SetHandler application/x-httpd-php-source
</FilesMatch>

This overrode the "AddType application/x-httpd-suphp .php" in the 
suphp.conf, that's why suphp never started.

So after all I removed the new lines, and added the old once again, to 
look like this:
# <FilesMatch "\.ph(p3?|tml)$">
#    SetHandler application/x-httpd-php

(Continue reading)

Michelle Konzack | 20 Feb 2011 18:41

Re: suPHP vs. Squeeze

Hello Sebestyén Dénes,

Am 2011-02-18 12:17:53, hacktest Du folgendes herunter:
> Solution:
> In the previous versions, the php5.conf apache configuration file
> had something like this:
>     AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml
> 
> After the upgrade. it changed to this:
> <FilesMatch "\.ph(p3?|tml)$">
>     SetHandler application/x-httpd-php
> </FilesMatch>
> <FilesMatch "\.phps$">
>     SetHandler application/x-httpd-php-source
> </FilesMatch>

This not a Bug in Squeeze but also in Lenny which I have reported to the
BTS long time ago!

Thanks, Greetings and nice Day/Evening
    Michelle Konzack

--

-- 
##################### Debian GNU/Linux Consultant ######################
   Development of Intranet and Embedded Systems with Debian GNU/Linux

itsystems <at> tdnet France EURL       itsystems <at> tdnet UG (limited liability)
Owner Michelle Konzack            Owner Michelle Konzack

Apt. 917 (homeoffice)

(Continue reading)

Daniel Llewellyn | 20 Feb 2011 19:32

Picon

Re: suPHP vs. Squeeze

On 20 Feb 2011, at 17:41, Michelle Konzack wrote:

> Hello Sebestyén Dénes,
> 
> Am 2011-02-18 12:17:53, hacktest Du folgendes herunter:
>> Solution:
>> In the previous versions, the php5.conf apache configuration file
>> had something like this:
>>    AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml
>> 
>> After the upgrade. it changed to this:
>> <FilesMatch "\.ph(p3?|tml)$">
>>    SetHandler application/x-httpd-php
>> </FilesMatch>
>> <FilesMatch "\.phps$">
>>    SetHandler application/x-httpd-php-source
>> </FilesMatch>
> 
> This not a Bug in Squeeze but also in Lenny which I have reported to the
> BTS long time ago!

That's not a bug at all. You can't expect to run the mod_php5 plugin and mod_suphp at the same time. The former
is what is configured by the file /etc/apache2/mods-available/php5.conf. disable that config file and
enable the suphp one (if it isn't already) and bob will be your proverbial uncle.

Regards,
	The Honeymonster aka Daniel Llewellyn - diddledan@...

Michelle Konzack | 21 Feb 2011 13:40

Re: suPHP vs. Squeeze

Hello Daniel Llewellyn,

Am 2011-02-20 18:32:25, hacktest Du folgendes herunter:
> That's not a bug at all. You can't expect to run the mod_php5 plugin
> and mod_suphp at the same time. The former is what is configured by
> the file /etc/apache2/mods-available/php5.conf. disable that config
> file and enable the suphp one (if it isn't already) and bob will be
> your proverbial uncle.

This would enable suPHH for the whole machine with all  VHost  which  is
not desirable. Also under Debian you can not configure "suPHP_UserGroup"

Imagine, on my system I have removed the original php5.conf entries long
time ago and it works perfectly.  suPHP  is  always  configured  in  the
VHosts where it is needed.

This should normaly the default.

I see runing suPHP on the WHOLE machine as a security risk to  the  data
of the users.

> Regards,
> 	The Honeymonster aka Daniel Llewellyn - diddledan@...

Thanks, Greetings and nice Day/Evening
    Michelle Konzack

--

-- 
##################### Debian GNU/Linux Consultant ######################
   Development of Intranet and Embedded Systems with Debian GNU/Linux

(Continue reading)

Roger B.A. Klorese | 23 Feb 2011 01:31

Re: suPHP vs. Squeeze

On 2/21/11 4:40 AM, Michelle Konzack wrote:
> Imagine, on my system I have removed the original php5.conf entries long
> time ago and it works perfectly.

...if you intend not to run mod_php.

> I see runing suPHP on the WHOLE machine as a security risk to  the  data
> of the users.

Isolating each user's data to that user is a security risk to the users?!

Achikbache Guilhem | 25 Feb 2011 14:44

Re: suPHP Digest, Vol 82, Issue 6

Actually, I have already shared my config on using mod_php and mod_suphp 
at the same time. I think it is required (on debian at least) because 
phpmyadmin and all other system wide web apps would be run as root... 
and then must be handled by mod_php and not suphp.

The whole point is about activating mod_suphp *before* mod_php, because 
mod_suphp can be disabled at runtime, not mod_php; if mod_php is 
configured first, it will handle all x-application-php types. But you 
can configure suphp to be enabled for vhosts only.

Please read 
https://lists.marsching.com/pipermail/suphp/2010-March/002322.html

PS : One more tip is available : run php4 AND php5 (or 6 or 7 or ...) at 
the same time thanks to suphp !

Le 23/02/2011 12:00, suphp-request@... a écrit :
> Send suPHP mailing list submissions to
> 	suphp@...
>
> To subscribe or unsubscribe via the World Wide Web, visit
> 	https://lists.marsching.com/mailman/listinfo/suphp
> or, via email, send a message with subject or body 'help' to
> 	suphp-request@...
>
> You can reach the person managing the list at
> 	suphp-owner@...
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of suPHP digest..."

(Continue reading)

Achikbache Guilhem | 25 Feb 2011 14:45

Re: suPHP vs. Squeeze


Le 23/02/2011 12:00, suphp-request@... a écrit :
> Send suPHP mailing list submissions to
> 	suphp@...
>
> To subscribe or unsubscribe via the World Wide Web, visit
> 	https://lists.marsching.com/mailman/listinfo/suphp
> or, via email, send a message with subject or body 'help' to
> 	suphp-request@...
>
> You can reach the person managing the list at
> 	suphp-owner@...
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of suPHP digest..."
>
>
>
> Today's Topics:
>
>     1. Re: suPHP vs. Squeeze (Roger B.A. Klorese)
>
>
>
> _______________________________________________
> suPHP mailing list
> suPHP@...
> https://lists.marsching.com/mailman/listinfo/suphp

Attachment (guilhem.vcf): text/x-vcard, 318 bytes

(Continue reading)

Achikbache Guilhem | 25 Feb 2011 14:58

Re: suPHP vs. Squeeze

Le -10/01/-28163 20:59, Daniel Llewellyn a écrit :
> On 20 Feb 2011, at 17:41, Michelle Konzack wrote:
>
>> Hello Sebestyén Dénes,
>>
>> Am 2011-02-18 12:17:53, hacktest Du folgendes herunter:
>>> Solution: In the previous versions, the php5.conf apache
>>> configuration file had something like this: AddType
>>> application/x-httpd-php .php .php3 .php4 .php5 .phtml
>>>
>>> After the upgrade. it changed to this: <FilesMatch
>>> "\.ph(p3?|tml)$"> SetHandler application/x-httpd-php
>>> </FilesMatch> <FilesMatch "\.phps$"> SetHandler
>>> application/x-httpd-php-source </FilesMatch>
>>
>> This not a Bug in Squeeze but also in Lenny which I have reported
>> to the BTS long time ago!
>
> That's not a bug at all. You can't expect to run the mod_php5 plugin
> and mod_suphp at the same time. The former is what is configured by
> the file /etc/apache2/mods-available/php5.conf. disable that config
> file and enable the suphp one (if it isn't already) and bob will be
> your proverbial uncle.

Actually, you can! I have already shared my config on using mod_php and
mod_suphp at the same time. I think it is required (on debian at least) 
because phpmyadmin and all other system wide web apps would be run as 
root... and then must be handled by mod_php and not suphp.

The whole point is about activating mod_suphp *before* mod_php, because

(Continue reading)

Group

gmane.comp.php.suphp.general.

Advertisement

Project Web Page

suPHP mailing list

Search Archive

Page

1 | 2

Articles in period: 12

February 2011

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

Compile/Build issue with new 0.7.2 version (6 Jun 2013)
suPHP End of Life Notice (22 May 2013)
Patch to allow configure against 2.4 Apache (20 May 2013)
Security Update Released (20 May 2013)
CLI - STDIN/STDOUT not defined (25 Mar 2013)
suPHP bypass Hack (22 Jan 2013)
(no subject) (26 Dec 2012)
ERROR-SUPHP-0.7.1-COMPILATION (9 Oct 2012)
660 permissions; need a system where multiple users are able to modify (23 Sep 2012)
mod suPHP crash while processing script output (19 Aug 2012)
suPHP not working centos 6.2 (11 Jul 2012)
suPHP not working centos 6.2 (10 Jul 2012)
Blank Page Error with wordpress (24 Jun 2012)
Error with opensuse (9 Jun 2012)
How to make chroot working? (29 May 2012)
suPHP, Oauth and the Authorization Header (10 May 2012)
suPHP, Oauth and the Authorization Header (10 May 2012)
suPHP and CVE-2012-1823 and CVE-2012-2311? (4 May 2012)
Problems with PHP-Sessions? (29 Mar 2012)
Problems with PHP-Sessions? (29 Mar 2012)
Apache 2.4.x (22 Mar 2012)

Archives

1	June 2013
3	May 2013
1	April 2013
1	March 2013
1	January 2013
2	December 2012
1	October 2012
3	September 2012
2	August 2012
2	July 2012
10	June 2012
7	May 2012
19	March 2012
8	February 2012
3	January 2012
9	December 2011
4	November 2011
3	October 2011
1	August 2011
11	July 2011
3	June 2011
10	May 2011
2	April 2011
5	March 2011
12	February 2011
20	January 2011
5	December 2010
16	November 2010
3	October 2010
11	September 2010
8	August 2010
9	July 2010
7	June 2010
7	April 2010
40	March 2010
13	February 2010
4	January 2010
22	December 2009
20	November 2009
35	October 2009
16	September 2009
5	August 2009
10	July 2009
9	June 2009
35	May 2009
6	April 2009
14	March 2009
2	February 2009
24	January 2009
21	December 2008
9	November 2008
11	October 2008
21	September 2008
9	August 2008
21	July 2008
43	June 2008
63	May 2008
128	April 2008
25	March 2008
31	February 2008
30	January 2008
21	December 2007
22	November 2007
4	October 2007
25	September 2007
26	August 2007
19	July 2007
30	June 2007
10	May 2007
12	April 2007
22	March 2007
23	February 2007
34	January 2007
17	December 2006
5	November 2006

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template