Okay, so just recently because my server has PHP's
safe_mode turned off, I had to make sure that
open_basedir was enabled for all my hostees's and myself.
DirectAdmin had a default line located in the
virtual_host.conf file but was not used as it had a hash before the line.
Looked like this:
#php_admin_value open_basedir |HOME|/:/tmp:/var/www/:/usr/local/lib/php/:/etc/virtual/
In a users httpd.conf it should look something like:
#php_admin_value open_basedir /home/james/:/tmp:/var/www/:/usr/local/lib/php/:/etc/virtual/
That line basically means that they have access to their own document root, the tmp folder, the main server root, php executables, and the global mail folder.
I was pretty sure this was very insecure, so I changed it a little. I made sure that they did not have access to the main document root folder, as well as restricting access to their own mail folders for that domain. So I ended up with something like this:
php_admin_value open_basedir |HOME|/:/tmp:/usr/local/lib/php/:/etc/virtual/|DOMAIN|/
So, in a users httpd.conf file, it would look like this:
php_admin_value open_basedir /home/james/:/usr/local/lib/php/:/etc/virtual/james.co.uk/
So that sums that bit up. Now this
virtual_host.conf file can be found in the folder
/usr/local/directadmin/data/templates. I suggest you browse there and start editing that file. You'll find that the
#php_admin_value open_basedir line would be near the bottom of the configuration. Now, I moved this in to the directory configuration rather than leaving it bound to the IP address. I'm not sure if it has any affect, but just to be sure add your new setting just above where this line ends:
</Directory>
Then you should have a configuration file that looks like this (Note: This is ONLY the bottom half of the file, not the full file):
<Directory |DOCROOT|>
Options +Includes -Indexes
php_admin_flag engine |PHP|
php_admin_flag safe_mode |SAFE_MODE|
php_admin_value sendmail_path '/usr/sbin/sendmail -t -i -f |USER|@|DOMAIN|'
php_admin_value open_basedir |HOME|/:/tmp:/usr/local/lib/php/:/etc/virtual/|DOMAIN|/
</Directory>
|HANDLERS|
|MIMETYPES|
</VirtualHost>
Once you have got all that done and you're happy. You'll need to execute a command via SSH to rewrite all the users configuration files so they are updated to your new configuration settings. Run this command (might have to hit [enter] twice to successfully complete the command):
echo "action=rewrite&value=httpd" >> /usr/local/directadmin/data/task.queue
/usr/local/directadmin/dataskq d
In a few minutes all your users configuration files will be re-written with your new line.
Posted by Steven Sullivan on 13th September, 2006 - 12:10:35 GMT