When I look at the virtual host details of my web service there’s a line, where myusername is the user name for the control panel account:
Use UserGroup myusername myusername
Yet the websites still run under Apache’s httpd user.
Why is that and can it be corrected?
I believe there’s a script that runs every 24 hours to change the user to myusername but it only changes the user and not the group. This means that any file with group write access is still vulnerable to anything running under the httpd user.
It would really make a great deal of sense to me if the website simply ran under myusername (as user AND group) rather than httpd as it increases security and prevents permissions issues between the Apache and FTP users.
Is this possible or am I missing something in my understanding?
It is actually depends how php runs if it runs as apache module it runs as httpd user but if it runs as fast cgi, it runs as actual user. If you have enabled to runs as Apache module, you can still increases security using .htaccess.
Great - thanks for that, I’ve located the necessary setting (for anyone else who has struggled with this it’s a matter of changing the ‘PHP Mode’ under the web services settings for the domain).
My confusion was that the PHP Mode used to give the option of switching between PHP4 and PHP5 (maybe still true for the older servers).
My confusion was also choosing between PHP and PHP Advanced. Is it possible to direct me to information that explains the differences between the two?
[edit] Cancel that last question, I’ve seen the answer. When using straight PHP, PHP Mode allows you to switch between PHP4 and PHP5 (if the option is even available - the newer servers only have PHP5). To switch to Fast CGI one must first switch to Advanced PHP and then PHP Mode gives Fast CGI as an option.