16 ms·

I did a quick look through PhpTheRightWay website, and I saw no mention of the advice that php user should have no permissions to change app code -- or in other

by theamk 7y ago

I did a quick look through PhpTheRightWay website, and I saw no mention of the advice that php user should have no permissions to change app code -- or in other words, that "deploy" and "run" users should be different. Is this the recommended practice now? Because that was the main reason to avoid PHP codebases for me. Having an app where any code execution bug instantly leads to permanent compromise scares me deeply.

Isinlor 7y ago
PHP was never receiving requests directly from the Internet. It was always a standard practice to talk to PHP trough a server. The separation between what you call deploy and run user is what you get as default by using Nginx or Apache on Ubuntu (root vs. www-data). If you feel very paranoid and don't mind some complexity you can put PHP code into a docker container and run it from there. In that setup, attacker targeting PHP code would need to break out of docker container to take full control over the server.
- theamk 7y ago
  That sounds nice -- but does this happens often in PHP world? Last PHP project I tried to install was OwnCloud, and it explicitly says (in [0]): > Your HTTP user must own the config/, data/, apps/ respectively the apps-external/ directories so that you can configure ownCloud, create, modify and delete your data files, and install apps via the ownCloud Web interface. [0] https://doc.owncloud.org/server/10.4/admin_manual/installation/installation_wizard.html#post-installation-steps https://doc.owncloud.org/server/10.4/admin_manual/installati...
  - Isinlor 7y ago
    A lot of PHP apps allow you to install plugins from within the app itself, without going trough the whole process of deployment. The app has to modify it's own code in that scenario. This is independent from programming language. If you allow users to independently install plugins you will allow them to execute third-party code - it's true for all programming languages. I don't know ownCloud, but I would guess they have an option to disable plugin installation. And as I said, if you feel paranoid, you can install PHP apps in docker container: https://doc.owncloud.org/server/10.4/admin_manual/installation/docker/ https://doc.owncloud.org/server/10.4/admin_manual/installati...

by theamk 7y ago

Isinlor 7y ago

PHP was never receiving requests directly from the Internet. It was always a standard practice to talk to PHP trough a server. The separation between what you call deploy and run user is what you get as default by using Nginx or Apache on Ubuntu (root vs. www-data). If you feel very paranoid and don't mind some complexity you can put PHP code into a docker container and run it from there. In that setup, attacker targeting PHP code would need to break out of docker container to take full control over the server.

theamk 7y ago
That sounds nice -- but does this happens often in PHP world? Last PHP project I tried to install was OwnCloud, and it explicitly says (in [0]): > Your HTTP user must own the config/, data/, apps/ respectively the apps-external/ directories so that you can configure ownCloud, create, modify and delete your data files, and install apps via the ownCloud Web interface. [0] https://doc.owncloud.org/server/10.4/admin_manual/installation/installation_wizard.html#post-installation-steps https://doc.owncloud.org/server/10.4/admin_manual/installati...
- Isinlor 7y ago
  A lot of PHP apps allow you to install plugins from within the app itself, without going trough the whole process of deployment. The app has to modify it's own code in that scenario. This is independent from programming language. If you allow users to independently install plugins you will allow them to execute third-party code - it's true for all programming languages. I don't know ownCloud, but I would guess they have an option to disable plugin installation. And as I said, if you feel paranoid, you can install PHP apps in docker container: https://doc.owncloud.org/server/10.4/admin_manual/installation/docker/ https://doc.owncloud.org/server/10.4/admin_manual/installati...