# AW:  Re: PDM Meeting Notes

- Thread: https://externals.io/message/20349
- Original archive: https://news-web.php.net/php.internals/20349
- Started by Matthias Pigulla on 2005-11-25T09:51:17+00:00
- Messages: 4
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #20349 — Matthias Pigulla — 2005-11-25T09:51:17+00:00

URL: https://externals.io/message/20349#20349

> > […]
> 
> We were in a continual losing race against that sort of thing though. 
> In pretty much every single release there have been ways to 
> do this that got around safe-mode.

Because of bugs in the safe_mode implementation (forgetting some
checks?) or conceptual problems?

> I have always maintained that shared hosts should be running 
> per-security context Apache instances as different users.

The problem with that is that it makes name-based virtual hosts pretty
pointless because each apache instance will at least need an ip address
on its own.

-mp.

---

## #20365 — Andreas Ahlenstorf — 2005-11-25T10:10:40+00:00

URL: https://externals.io/message/20349#20365 · In reply to: #20349

Am 25.11.2005 um 10:51 schrieb Matthias Pigulla:

> Because of bugs in the safe_mode implementation (forgetting some
> checks?) or conceptual problems?

Safe mode doesn't work 'cos there are lots of third party libraries  
which PHP relies on and don't take care of the safe mode. That's why  
you can't assure security in you application and why it's up to your  
operating system to care about security.

> > […]
>
> The problem with that is that it makes name-based virtual hosts pretty
> pointless because each apache instance will at least need an ip  
> address
> on its own.

It seems you've never heard of suexec, FastCGI, MPM Perchild (ok,  
this one is broken) and Zeus (has nothing to do with Apache, but is a  
good product). It's possible to have name based virtual hosts in  
Apache2 and PHP processes running in the context of every user with a  
patched suexec, mod_fastcgi and one single IP.

Regards,
A.

---

## #20377 — Andreas Ahlenstorf — 2005-11-25T10:29:38+00:00

URL: https://externals.io/message/20349#20377 · In reply to: #20365

> That's why you can't assure security...

Please read: ... this special type of security...

Regards,
A.

---

## #20413 — Rasmus Lerdorf — 2005-11-25T15:46:15+00:00

URL: https://externals.io/message/20349#20413 · In reply to: #20349

Matthias Pigulla wrote:
>  
> > […]
> 
> Because of bugs in the safe_mode implementation (forgetting some
> checks?) or conceptual problems?
> 
> > […]
> 
> The problem with that is that it makes name-based virtual hosts pretty
> pointless because each apache instance will at least need an ip address
> on its own.

That's not true at all.  I run multiple Apaches all the time behind a 
single IP.  In my main port 80 server I simply have config lines like this:

<VirtualHost *>
  ServerName example1.com
  ...
  ProxyPass / http://example1.com:81/
</VirtualHost>

<VirtualHost *>
  ServerName example2.com
  ...
  ProxyPass / http://example2.com:82/
</VirtualHost>

That's just using Apache's mod_proxy.  You can do the same thing with 
Squid in reverse proxy mode and you can get really fancy with redirect 
scripts where you keep all your vhosts in a database and cache them and 
control the redirection that way.

-Rasmus