What is this "security concept" all about?

[schlimpf]

Hello,

I am just wondering what kind of security Plesk Panel is trying to reach with things like open_basedir etc.
As an attacker, if I can execute PHP on the server, I can just execute a perl script which then can read all dirs/files that are readable by apache from the COMPLETE server. There is as far as I know no way to prevent this with only Plesk configuration.
So basically I try to break in some CMS like WordPress, upload a PHP script with it and then I got a whole lot more possibilities as "just" messing with the httpdocs folder.
This will of course work if Perl is DISABLED for the domain.

Feedback from the Plesk team is greatly appreciated.

If anyone is concerned about his/her security and dont know how to fix issues like this, you can contact me via PM.

Best
Mario

 

[schlimpf]

How about a chrooted environment for the apache process and/or the PHP FastCGI processes? I think this would be a huge step forward in security and willl give plesk a killer feature that is not available on competitor software like cPanel!

 

[danami]

If you want isolation then take a look at mod_ruid2 or cloudlinux with cagefs.

mod_ruid2
https://github.com/mind04/mod-ruid2

Plesk addon for mod_ruid2
http://forum.parallels.com/showthread.php?106297-Run-PHP-as-User

Good writeup on Cloudlinux
http://blog.hawkhost.com/2013/02/28/introducing-cagefs-a-quick-overview/

From everything I've read cloudlinux and cagefs is the way to go.