lighttpd Problem: Virtual Host mit falscher UID | uneingeschränktes Ordner Browsing
Posted: 2007-10-14 22:11
Hallo,
lighttpd läuft mit falscher UID, Virtual Hosts nutzen nicht ihren Document.Root und die php.ini lesbar.
Könntet ihr mich bitte bei der Fehlersuche unterstützen?
System: Debian/etch - lighttpd 1.4.13-4etch4 - php5-cgi 5.2.0-8+etch7
Vorgegangen nach diesem HowTo: http://trac.lighttpd.net/trac/wiki/HowT ... ermissions
Server selbst ist erstmal dank Firewall vom Netz getrennt.
1# /etc/lighttpd/lighttpd.conf
2# Ordnerbaumstruktur mit vollständigen Berechtigungen
3# fastcgi Startupscript
Verzeichnisstruktur
bewegungs-startup.sh
Muss ich dieses socket file anlegen? für was ist dies da?
Grüße sonnenrot
lighttpd läuft mit falscher UID, Virtual Hosts nutzen nicht ihren Document.Root und die php.ini lesbar.
Könntet ihr mich bitte bei der Fehlersuche unterstützen?
System: Debian/etch - lighttpd 1.4.13-4etch4 - php5-cgi 5.2.0-8+etch7
Vorgegangen nach diesem HowTo: http://trac.lighttpd.net/trac/wiki/HowT ... ermissions
Server selbst ist erstmal dank Firewall vom Netz getrennt.
1# /etc/lighttpd/lighttpd.conf
2# Ordnerbaumstruktur mit vollständigen Berechtigungen
3# fastcgi Startupscript
Code: Select all
server.modules = (
"mod_access",
"mod_alias",
"mod_accesslog",
"mod_fastcgi",
)
fastcgi.server = ( ".php" => ((
"bin-path" => "/usr/bin/php5-cgi",
"socket" => "/tmp/php.socket",
"max-procs" => 2,
"bin-environment" => (
"PHP_FCGI_CHILDREN" => "5",
"PHP_FCGI_MAX_REQUESTS" => "1000"
),
"bin-copy-environment" => (
"PATH", "SHELL", "USER"
),
"broken-scriptfilename" => "enable"
)))
server.document-root = "/var/www/vhosts/"
server.errorlog = "/var/log/lighttpd/error.log"
server.tag = "webserver"
static-file.exclude-extensions = ( ".fcgi", ".php", ".rb", "~", ".inc", ".pl" )
index-file.names = ( "index.php", "index.html",
"index.htm", "default.htm" )
accesslog.filename = "/var/log/lighttpd/access.log"
url.access-deny = ( "~", ".inc" )
server.port = 3040
server.pid-file = "/var/run/lighttpd.pid"
dir-listing.encoding = "utf-8"
server.dir-listing = "enable"
server.username = "lighty"
server.groupname = "lighty"
$HTTP["remoteip"] =~ "127.0.0.1" {
alias.url += (
"/doc/" => "/usr/share/doc/",
"/images/" => "/usr/share/images/"
)
$HTTP["url"] =~ "^/doc/|^/images/" {
dir-listing.activate = "enable"
}
}
include_shell "/usr/share/lighttpd/create-mime.assign.pl"
include_shell "/usr/share/lighttpd/include-conf-enabled.pl"
$HTTP["host"] =~ "(^|.)strategiekongress.org$" {
server.document-root = "/var/www/vhosts/bewegung/html"
server.errorlog = "/var/www/vhosts/bewegung/logs/error_log"
accesslog.filename = "/var/www/vhosts/bewegung/logs/access_log"
fastcgi.server = ( ".php" =>
(
( "socket" => "/var/www/fastcgi/bewegung/bewegung.socket",
"broken-scriptfilename" => "enable"
)
)
)
}Code: Select all
|-- [drwxr-xr-x lighty lighty ] fastcgi
| |-- [drwxr-x--- vh_user vh_user ] vh_user
| | |-- [srwxrwx--- vh_user vh_user ] vh_user.socket
| | `-- [-rw-r--r-- root root ] php.ini
| `-- [drwxr-x--- root root ] startup
| `-- [-rwxr-x--- root root ] vh_user-startup.sh
`-- [drwxr-xr-x lighty lighty ] vhosts
`-- [drwxr-x--- vh_user vh_user ] vh_user
|-- [drwxr-x--- vh_user vh_user ] html
| `-- [-rw-r----- vh_user vh_user ] index.php
`-- [drwxr-x--- lighty vh_user ] logs
|-- [-rw-r--r-- lighty lighty ] access_log
`-- [-rw-r--r-- lighty lighty ] error_log
Code: Select all
#!/bin/sh
## ABSOLUTE path to the spawn-fcgi binary
SPAWNFCGI="/usr/bin/spawn-fcgi"
## ABSOLUTE path to the PHP binary
FCGIPROGRAM="/usr/bin/php5-cgi"
## bind to tcp-port on localhost
FCGISOCKET="/var/www/fastcgi/vh_host/vh_host.socket" Code: Select all
## uncomment the PHPRC line, if you want to have an extra php.ini for this user
## open_basedir = /var/www/vhosts/vh_host/html
##
PHPRC="/var/www/fastcgi/vh_host/"
## number of PHP childs to spawn in addition to the default. Minimum of 2.
## Actual childs = PHP_FCGI_CHILDREN + 1
PHP_FCGI_CHILDREN=5
## number of request server by a single php-process until is will be restarted
PHP_FCGI_MAX_REQUESTS=1000
## IP adresses where PHP should access server connections from
FCGI_WEB_SERVER_ADDRS="127.0.0.1"
# allowed environment variables sperated by spaces
ALLOWED_ENV="PATH USER"
## if this script is run as root switch to the following user
USERID=vh_host
GROUPID=vh_host
################## no config below this line
if test x$PHP_FCGI_CHILDREN = x; then
PHP_FCGI_CHILDREN=5
fi
export PHP_FCGI_MAX_REQUESTS
export FCGI_WEB_SERVER_ADDRS
export PHPRC
ALLOWED_ENV="$ALLOWED_ENV PHP_FCGI_MAX_REQUESTS FCGI_WEB_SERVER_ADDRS PHPRC"
# copy the allowed environment variables
E=
for i in $ALLOWED_ENV; do
E="$E $i=$(eval echo "$$i")"
done
# clean environment and set up a new one
env - $E $SPAWNFCGI -s $FCGISOCKET -f $FCGIPROGRAM -u $USERID -g $GROUPID -C $PHP_FCGI_CHILDREN
chmod 770 $FCGISOCKET