Nginx + php-fpm needs open_basedir
Posted: Sat Oct 15, 2016 3:38 pm
Missing open_basedir in /etc/php-fpm.d/*.conf files. How to structurally fix this in the php-fpm template? The vestacp version I'm using is 0.9.8-16
I noticed by running this php file which successfully dumps the system file:
After investigating I do see that the Apache template files add this to the apache configuration file. However I'm using Nginx.
The best location to add the open_basedir configuration are the /etc/php-fpm.d/*.conf files. Technically the open_basedir configuration can also be configured in the nginx conf file. This would then look like how vestacp did it for Apache. However then this needs to be done for all fastcgi_pass sections which can easily be forgotten. When you forget one instance then it wil expose your server. Apache normally use one entry to pass to php-fpm and uses .htaccess. Nginx doesn't use .htaccess and often uses multiple fastcgi_pass sections. E.g. Magento delivers it's own nginx conf.
For that reason I really think that the open_basedir configuration should be done in the /etc/php-fpm.d/*.conf files and I think Apache can also benefit from this approach.
I noticed by running this php file which successfully dumps the system file:
Code: Select all
<?php
echo file_get_contents('/etc/passwd');
The best location to add the open_basedir configuration are the /etc/php-fpm.d/*.conf files. Technically the open_basedir configuration can also be configured in the nginx conf file. This would then look like how vestacp did it for Apache. However then this needs to be done for all fastcgi_pass sections which can easily be forgotten. When you forget one instance then it wil expose your server. Apache normally use one entry to pass to php-fpm and uses .htaccess. Nginx doesn't use .htaccess and often uses multiple fastcgi_pass sections. E.g. Magento delivers it's own nginx conf.
For that reason I really think that the open_basedir configuration should be done in the /etc/php-fpm.d/*.conf files and I think Apache can also benefit from this approach.