Hello Virtualmin Community,
i am absolutely new to Virtualmin and just installed installed it on my fresh and new Ubuntu 10.04.1 Server and am very surprised how great everything worked so far. But of course there are always some problems as well...
First of all I wanted to lock virtual server admins and users in their homedirs only. Therefore I enabled the restriction for proftpd and granted only root access to the ssh server. This seems to work so far as the administrative virtual domain users now cannot login to the ssh shell and have only their homedir in the ftp. But some one here ("andreychek" in this thread: http://www.virtualmin.com/node/11192 ) stated that all this is useless if someone should install a web based file browser and he could than see all files on the server. This would be absolutely unacceptable for me! I gave it a short test with http://phpfm.sourceforge.net/ and so far it looked like users can't leave their homedir. But still please tell me if there are still any possibilities for the virtual server admins to get out their directories and how I can prevent this. This is really crucial for me and after the post of andreychek I am quite unsure about this...
While testing the php file manager I also noticed that only the global php.ini is used. For testing I activated safe mode for the virtual server I installed the php file manager on and also added open basedir restrictions in the php.ini (and of course restarted the apache2 daemon). No use and a php info script tells me that /etc/php5/apache2/php.ini is used...
Thanks for any help!
But some one here ("andreychek" in this thread: http://www.virtualmin.com/node/11192 ) stated that all this is useless if someone should install a web based file browser and he could than see all files on the server
Hrm, that does sound like something I would say :-)
However, I'd like to clarify that they couldn't see "all" files, but instead they can see files they have permission to see.
That is, they can't just go and browse another users data.
They could, however, see files that are set to allow anyone to read them (ie, world read permissions).
If that's not okay with you, then that's a remarkably difficult problem to solve :-)
The problem is that a lot of scripts require applications and libraries that are available on your server. For example, if you were able to lock PHP scripts into /home/USERNAME, that would prevent it from being able to communicate with MySQL, to call out to imagemagick binaries in /usr/bin, and may make it tricky to send email using the "mail" command.
I don't know of a simple way to solve all that... and with that in mind, my suggestion is to sigh, and simply move forward knowing that users may be able to view files that are world readable on your system if they really want to :-)
-Eric
Thanks for the answer!
I also don't want to mess with the file permissions but at least do all what is possible. On my old server (no Virtualmin but some non standard tool form the server provider) from which I want to move I had open_basedir restrictions for each virtal server. I think that's quite effective and should do the trick as long as the shell is disabled and the ftp restrictions work (what's the case).
So the two main questions in my mind now are:
Why is the php.ini for each user not used and how can I get my server to use it (I cannot set the basedir restrictions in the global php.ini of course)? And by the way all settings from Virtualmin -> Server Configurations for a virtual host have no effect as well as they are saved to the users php.ini...
Are there any other scripting languages besides php enabled for virtual hosts by default and can I disable them? I have no idea if it could be possible with other languages to access files but the critical domains should only need php5/MySQL so it shouldn't be a problem to disable any other stuff.
Again thanks for any help!
/edit: My php.ini problem seems to be a Ubuntu specific problem which I could fix by disabling mod_php as mod_fcgid should be enough (see this thread: http://www.virtualmin.com/node/15141 ). Now I assigned open_basedirs, changed the user and group of the users php.ini file to root with only root allowed to write the file and disabled the PHP 5 Configuration for that user in Virtualmin. Now only root should be able to change this... Still I don't know where and how do disable other scripting languages like ruby for example (if they are even enabled right now). So if somebody could give me some help on this it would be nice.
Howdy,
Just to be clear, the only dynamic language you want available on your sites should be PHP?
I believe you could accomplish that by disabling cgi-bin, and verifying that your domains are setup without the "ExecCGI" option.
You can do that by going into System Settings -> Server Templates -> Default -> Apache Website, and you'll see the VirtualHost template used near the top in "Directives and settings for new websites".
You'd want to comment out the entire block where the "cgi-bin" directory is defined, and just make sure that ExecCGI is not listed in any of the "Options" in there.
-Eric