Php open_basedir settings and security

#! /Usr/bin/k4shifz

I read junshen's blog and came back to study it.

Open_basedir can restrict the activity scope of files accessed by users to a specified region. It is usually the path of the home directory, and the symbol "." can be used to represent the current directory. Note that the restriction specified by open_basedir is actually a prefix rather than a directory name.
For example, if "open_basedir =/dir/user", the directories "/dir/user" and "/dir/other" are accessible. Therefore, if you want to restrict access to a specified directory only, end the path with a slash.
Open_basedir can also set multiple directories. In Windows, use semicolons to separate directories and use colons to separate directories in any other system. When it acts on the Apache module, the open_basedir path in the parent directory is automatically inherited.

There are three configuration methods for Apache + PHP:
Method 1: Configure in php. ini
Open_basedir =.:/tmp/

Method 2: Set (httpd-vhosts.conf) in VirtualHost configured in Apache)
Php_admin_value open_basedir.:/tmp/

Method 3: Set in Direcotry of Apache configuration
Php_admin_value open_basedir.:/tmp/

Explanation of the three configuration methods:
A. The priority of method 2 is higher than method 1, that is, method 2 will overwrite method 1; Method 3 has a higher priority than method 2, that is, method 3 will overwrite method 2;
B. Add "/tmp/" to the configuration directory because the default temporary php files (such as uploaded files and sessions) are stored in this directory. Therefore, you generally need to add this directory, otherwise, some functions are unavailable;
C. Add "." To the configuration directory to the current directory where the PHP file is run. This avoids setting each site one by one;
D. If the site also uses files outside the site directory, you need to set this directory separately on the corresponding VirtualHost;

Zookeeper ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Here is an example of my experiment. Two hosts are set. Of course, the method for setting vitualHost in Apache is also listed in one module:

# VM configuration file

NameVirtualHost *: 80

# Simple Setting Mode
<VirtualHost *: 80>
ServerAdmin admin@8100.cc
DocumentRoot "C:/AWEB/phproot/test"
ServerName localhost
# ServerAlias www.test.com
ErrorLog "logs/error. log"
CustomLog "logs/access. log" common
</VirtualHost>
# Detailed Setting Mode
<VirtualHost *: 80>
ServerAdmin admin@cc.cc
DocumentRoot "C:/AWEB/phproot/test2"
ServerName www.test2.com
# Php_admin_value open_basedir C:/AWEB/phproot/test2/; C:/windows/temp/
<Directory "C:/AWEB/phproot/test2">
Options Indexes FollowSymLinks
AllowOverride Options FileInfo
Order allow, deny
Allow from all
DirectoryIndex index.htm index.html index. php
Php_admin_value open_basedir c:/AWEB/phproot/test2/; C:/windows/temp/
</Directory>
Alias/phpmyadmin "C:/AWEB/phpMyAdmin /"
<Directory "C:/AWEB/phpMyAdmin">
AllowOverride AuthConfig
Order allow, deny
Allow from all
</Directory>
ErrorLog "logs/error. log"
CustomLog "logs/access. log" common
</VirtualHost>

Zookeeper ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Finally, the two statements about turning to the military God:

I. The existence of directories is not strictly considered when processing file paths in open_basedir. This will cause local inclusion or bypassing local file reading (merging/aaa /.. /.. /causes the linux directory check to be voided ).

Ii. Improper configuration of open_basedir values may lead to directory traversal (the last slash/is missing during directory configuration /).