WS7 with PHP for mass hosting: security?

Question

Hello everybody! I would like to run WS7u1 on our solaris10 T1000 for mass hosting. Unfortunately, it seems that it is not realistic:
- A copy of WS7u1 plus a copy of PHP use 400MB of disk space in a non-global zone, which greatly limits the number of sites that can be hosted on a 80GB disk.
- Hosting without zones is insecure with PHP as FastCGI, and slow with PHP as CGI. Unfortunately, WS7u1 does not support suexec
What would you recommend?
I would particularely like to know if i can run fastcgi + php with each php instance setuid to the customer's userid.
Thank you!
chris

Answer 1

Hmm.
I'm thinking that the solution I describe in the blog entry could work with one minor addition: chroot jails for each PHP engine.
I haven't tested this, but I suspect that something like:
Service fn=responder-fastcgi
        app-path="/export/WS7/third-party/php/php_fcgi"
        bind-path="$(lc($urlhost))"
        type="*magnus-internal/fastcgi*"
        app-env="PHPRC=/path/to/$(lc($urlhost))/config"
        app-env="PHP_FCGI_CHILDREN=10"
        app-env="PHP_FCGI_MAX_REQUEST=400"
        chroot=/path/to/$(lc($urlhost))/might work (after, of course, providing the appropriate chroot environment for PHP at each user's directory). You may need to fudge around witht he bin-path to get the path right, etc, but I think in general this would do what you want.
You could also use suexec (I think) as described earlier to make sure that each PHP instance ran with its own UID. Maybe combine that with the lookup() obj.conf parameter to store a table of UID -> VS mappings.
I think some experimentation is needed, but chroot or suexec both seem like good paths to take if you want to make certain that the PHP engines are unable to interact with each other.