DirectAdmin: How to change your virtual_host.conf (users httpd.conf)
Okay, so just recently because my server has PHP's safe_mode turned off, I had to make sure that open_basedir was enabled for all my hostees's and myself.

DirectAdmin had a default line located in the virtual_host.conf file but was not used as it had a hash before the line.

Looked like this:
#php_admin_value open_basedir |HOME|/:/tmp:/var/www/:/usr/local/lib/php/:/etc/virtual/
In a users httpd.conf it should look something like:
#php_admin_value open_basedir /home/james/:/tmp:/var/www/:/usr/local/lib/php/:/etc/virtual/
That line basically means that they have access to their own document root, the tmp folder, the main server root, php executables, and the global mail folder.

I was pretty sure this was very insecure, so I changed it a little. I made sure that they did not have access to the main document root folder, as well as restricting access to their own mail folders for that domain. So I ended up with something like this:
php_admin_value open_basedir |HOME|/:/tmp:/usr/local/lib/php/:/etc/virtual/|DOMAIN|/
So, in a users httpd.conf file, it would look like this:
php_admin_value open_basedir /home/james/:/usr/local/lib/php/:/etc/virtual/james.co.uk/
So that sums that bit up. Now this virtual_host.conf file can be found in the folder /usr/local/directadmin/data/templates. I suggest you browse there and start editing that file. You'll find that the #php_admin_value open_basedir line would be near the bottom of the configuration. Now, I moved this in to the directory configuration rather than leaving it bound to the IP address. I'm not sure if it has any affect, but just to be sure add your new setting just above where this line ends:
</Directory>
Then you should have a configuration file that looks like this (Note: This is ONLY the bottom half of the file, not the full file):

<Directory |DOCROOT|>
Options +Includes -Indexes
php_admin_flag engine |PHP|
php_admin_flag safe_mode |SAFE_MODE|
php_admin_value sendmail_path '/usr/sbin/sendmail -t -i -f |USER|@|DOMAIN|'
php_admin_value open_basedir |HOME|/:/tmp:/usr/local/lib/php/:/etc/virtual/|DOMAIN|/
</Directory>
|HANDLERS|
|MIMETYPES|

</VirtualHost>

Once you have got all that done and you're happy. You'll need to execute a command via SSH to rewrite all the users configuration files so they are updated to your new configuration settings. Run this command (might have to hit [enter] twice to successfully complete the command):
echo "action=rewrite&value=httpd" >> /usr/local/directadmin/data/task.queue /usr/local/directadmin/dataskq d
In a few minutes all your users configuration files will be re-written with your new line.
SOCIAL BOOKMARK - Posted by Steven Sullivan on 13th September, 2006 - 18:10:35 GMT

Comments

1

Posted by Vladimir on 20th August, 2008 at 13:33:36 GMT


Does this setting affect global open_basedir restrictions, which are set up under administrator settings? If open_basedir is turned off there, will these settings be working?
2

Posted by Steven Sullivan on 20th August, 2008 at 13:58:41 GMT


DirectAdmin has since fixed their security flaws when they introduced the open_basedir settings. This post was in 2006.

DirectAdmin now lets you modify this setting the correct way. Here\'s more help: http://help.directadmin.com/item.php?id=182

Note the code on the knowledge base is in the global template system which is just as easily editable to add more or less paths for this restriction.


* Name:
* E-Mail:
Not shown to public
Website:
Emotions:
* Comment:

Up

Down

characters left
* Security Code:
Type this code in the box: 827280
* Required field
© Steven Sullivan 2006 - All Rights Reserved         Video Disclaimer - Valid XHTML & CSS