Skip to content

Commit 5cb8249

Browse files
jaapmarcusjaapmarcus
authored
Make /etc/phpmyadmin/ not accessable for users (hestiacp#1945)
* Run phpmyadmin under www.conf * Update installers to limit access PHPmyadmin to www-data only * Limit access users * Prevent users to read hestia-sso.php * Update upgrade.php * Remove phpmyadmin, roundcube, rainloop out of openbase dir domains For users to use www.conf for accessing those sites! * Include upgrade script * Add template for modphp users * Update changelog * Update update script
1 parent 71c1606 commit 5cb8249

File tree

13 files changed

+141
-19
lines changed

13 files changed

+141
-19
lines changed

‎CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ All notable changes to this project will be documented in this file.
66
### Features
77

88
- Add nginx user_agent separation to desktop/mobile (e.g. for fastcgi cache)
9+
- Run phpmyadmin folder under www-data user instead of "user" improving security. (Reported via Discord)
10+
- Added new template for mod php users to access phpmymyadmin
911

1012
### Bugfixes
1113

‎bin/v-add-sys-pma-sso‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,9 +84,10 @@ sed -i "s/%API_HESTIA_PORT%/$BACKEND_PORT/g" $PMA_INSTALL/hestia-sso.php
8484

8585

8686
# Check if config already contains the keys
87-
8887
touch $PMA_CONFIG/hestia-sso.inc.php
89-
chmod 644 $PMA_CONFIG/hestia-sso.inc.php
88+
chmod 640 $PMA_CONFIG/hestia-sso.inc.php
89+
chown root:www-data $PMA_CONFIG/hestia-sso.inc.php
90+
9091
echo "<?php
9192
if(isset(\$_GET['hestia_token']) || isset(\$_COOKIE['SignonSession'])){
9293
\$cfg['Servers'][\$i]['auth_type'] = 'signon';

‎func/upgrade.sh‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -483,7 +483,8 @@ upgrade_phpmyadmin() {
483483
echo "[ ! ] Verifying phpMyAdmin v${pma_release_file##*-} installation..."
484484
# Update permissions
485485
if [ -e /var/lib/phpmyadmin/blowfish_secret.inc.php ]; then
486-
chmod 0644 /var/lib/phpmyadmin/blowfish_secret.inc.php
486+
chown root:www-data /var/lib/phpmyadmin/blowfish_secret.inc.php
487+
chmod 0640 /var/lib/phpmyadmin/blowfish_secret.inc.php
487488
fi
488489
else
489490
# Display upgrade information
@@ -497,7 +498,7 @@ upgrade_phpmyadmin() {
497498
tar xzf phpMyAdmin-$pma_v-all-languages.tar.gz
498499

499500
# Delete file to prevent error
500-
rm -fr /usr/share/phpmyadmin/doc/html
501+
rm -rf /usr/share/phpmyadmin/doc/html
501502

502503
# Overwrite old files
503504
cp -rf phpMyAdmin-$pma_v-all-languages/* /usr/share/phpmyadmin
@@ -509,11 +510,14 @@ upgrade_phpmyadmin() {
509510
# Create temporary folder and change permissions
510511
if [ ! -d /usr/share/phpmyadmin/tmp ]; then
511512
mkdir /usr/share/phpmyadmin/tmp
512-
chmod 777 /usr/share/phpmyadmin/tmp
513+
chown root:www-data /usr/share/phpmyadmin/tmp
514+
chmod 770 /usr/share/phpmyadmin/tmp
515+
513516
fi
514517

515518
if [ -e /var/lib/phpmyadmin/blowfish_secret.inc.php ]; then
516-
chmod 0644 /var/lib/phpmyadmin/blowfish_secret.inc.php
519+
chown root:www-data /var/lib/phpmyadmin/blowfish_secret.inc.php
520+
chmod 0640 /var/lib/phpmyadmin/blowfish_secret.inc.php
517521
fi
518522

519523
# Clean up source files

‎install/deb/php-fpm/multiphp.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ pm.status_path = /status
1717

1818
php_admin_value[upload_tmp_dir] = /home/%user%/tmp
1919
php_admin_value[session.save_path] = /home/%user%/tmp
20-
php_admin_value[open_basedir] = /home/%user%/web/%domain%/public_html:/home/%user%/web/%domain%/private:/home/%user%/web/%domain%/public_shtml:/home/%user%/tmp:/var/www/html:/etc/phpmyadmin:/var/lib/phpmyadmin:/etc/phppgadmin:/etc/roundcube:/var/lib/roundcube:/tmp:/bin:/usr/bin:/usr/local/bin:/usr/share:/opt
20+
php_admin_value[open_basedir] = /home/%user%/web/%domain%/public_html:/home/%user%/web/%domain%/private:/home/%user%/web/%domain%/public_shtml:/home/%user%/tmp:/var/www/html:/bin:/usr/bin:/usr/local/bin:/usr/share:/opt
2121
php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f admin@%domain%
2222

2323
env[PATH] = /usr/local/bin:/usr/bin:/bin

‎install/deb/pma/apache.conf‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,12 @@ Alias /%pma_alias% /usr/share/phpmyadmin
1717
php_admin_value upload_tmp_dir /var/lib/phpmyadmin/tmp
1818
php_admin_value open_basedir /usr/share/phpmyadmin/:/etc/phpmyadmin/:/var/lib/phpmyadmin/:/usr/share/php/php-gettext:/usr/share/javascript/
1919
</IfModule>
20-
20+
<IfModule mpm_event_module>
21+
# Use www.conf instead
22+
<FilesMatch \.php$>
23+
SetHandler "proxy:fcgi://127.0.0.1:9000"
24+
</FilesMatch>
25+
</IfModule>
2126
</Directory>
2227

2328
# Authorize for setup

‎install/deb/templates/web/apache2/www-data.stpl‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#=======================================================================#
2+
# Default Web Domain Template #
3+
# DO NOT MODIFY THIS FILE! CHANGES WILL BE LOST WHEN REBUILDING DOMAINS #
4+
#=======================================================================#
5+
6+
# PHPMyAdmin and phppgadmin require access as www-data instead of user for security reasons
7+
<VirtualHost %ip%:%web_ssl_port%>
8+
9+
ServerName %domain_idn%
10+
%alias_string%
11+
ServerAdmin %email%
12+
DocumentRoot %sdocroot%
13+
ScriptAlias /cgi-bin/ %home%/%user%/web/%domain%/cgi-bin/
14+
Alias /vstats/ %home%/%user%/web/%domain%/stats/
15+
Alias /error/ %home%/%user%/web/%domain%/document_errors/
16+
#SuexecUserGroup %user% %group%
17+
CustomLog /var/log/%web_system%/domains/%domain%.bytes bytes
18+
CustomLog /var/log/%web_system%/domains/%domain%.log combined
19+
ErrorLog /var/log/%web_system%/domains/%domain%.error.log
20+
<Directory %sdocroot%>
21+
AllowOverride All
22+
SSLRequireSSL
23+
Options +Includes -Indexes +ExecCGI
24+
php_admin_value open_basedir %sdocroot%:%home%/%user%/tmp
25+
php_admin_value upload_tmp_dir %home%/%user%/tmp
26+
php_admin_value session.save_path %home%/%user%/tmp
27+
php_admin_value sys_temp_dir %home%/%user%/tmp
28+
</Directory>
29+
<Directory %home%/%user%/web/%domain%/stats>
30+
AllowOverride All
31+
</Directory>
32+
SSLEngine on
33+
SSLVerifyClient none
34+
SSLCertificateFile %ssl_crt%
35+
SSLCertificateKeyFile %ssl_key%
36+
%ssl_ca_str%SSLCertificateChainFile %ssl_ca%
37+
38+
IncludeOptional %home%/%user%/conf/web/%domain%/%web_system%.ssl.conf_*
39+
40+
</VirtualHost>
41+

‎install/deb/templates/web/apache2/www-data.tpl‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#=======================================================================#
2+
# Default Web Domain Template #
3+
# DO NOT MODIFY THIS FILE! CHANGES WILL BE LOST WHEN REBUILDING DOMAINS #
4+
#=======================================================================#
5+
6+
# PHPMyAdmin and phppgadmin require access as www-data instead of user for security reasons
7+
<VirtualHost %ip%:%web_port%>
8+
9+
ServerName %domain_idn%
10+
%alias_string%
11+
ServerAdmin %email%
12+
DocumentRoot %docroot%
13+
ScriptAlias /cgi-bin/ %home%/%user%/web/%domain%/cgi-bin/
14+
Alias /vstats/ %home%/%user%/web/%domain%/stats/
15+
Alias /error/ %home%/%user%/web/%domain%/document_errors/
16+
#SuexecUserGroup %user% %group%
17+
CustomLog /var/log/%web_system%/domains/%domain%.bytes bytes
18+
CustomLog /var/log/%web_system%/domains/%domain%.log combined
19+
ErrorLog /var/log/%web_system%/domains/%domain%.error.log
20+
21+
IncludeOptional %home%/%user%/conf/web/%domain%/forcessl.apache2.conf*
22+
23+
<Directory %docroot%>
24+
AllowOverride All
25+
Options +Includes -Indexes +ExecCGI
26+
php_admin_value open_basedir %docroot%:%home%/%user%/tmp
27+
php_admin_value upload_tmp_dir %home%/%user%/tmp
28+
php_admin_value session.save_path %home%/%user%/tmp
29+
php_admin_value sys_temp_dir %home%/%user%/tmp
30+
</Directory>
31+
<Directory %home%/%user%/web/%domain%/stats>
32+
AllowOverride All
33+
</Directory>
34+
35+
IncludeOptional %home%/%user%/conf/web/%domain%/%web_system%.conf_*
36+
37+
</VirtualHost>
38+

‎install/deb/templates/web/php-fpm/default.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ pm.status_path = /status
1717

1818
php_admin_value[upload_tmp_dir] = /home/%user%/tmp
1919
php_admin_value[session.save_path] = /home/%user%/tmp
20-
php_admin_value[open_basedir] = /home/%user%/web/%domain%/public_html:/home/%user%/web/%domain%/private:/home/%user%/web/%domain%/public_shtml:/home/%user%/tmp:/var/www/html:/etc/phpmyadmin:/var/lib/phpmyadmin:/etc/phppgadmin:/etc/roundcube:/var/lib/roundcube:/etc/rainloop:/var/lib/rainloop:/tmp:/bin:/usr/bin:/usr/local/bin:/usr/share:/opt
20+
php_admin_value[open_basedir] = /home/%user%/web/%domain%/public_html:/home/%user%/web/%domain%/private:/home/%user%/web/%domain%/public_shtml:/home/%user%/tmp:/tmp:/bin:/usr/bin:/usr/local/bin:/usr/share:/opt
2121
php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f admin@%domain%
2222

2323
env[HOSTNAME] = $HOSTNAME

‎install/deb/templates/web/php-fpm/no-php.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717

1818
;php_admin_value[upload_tmp_dir] = /home/%user%/tmp
1919
;php_admin_value[session.save_path] = /home/%user%/tmp
20-
;php_admin_value[open_basedir] = /home/%user%/web/%domain%/public_html:/home/%user%/web/%domain%/public_shtml:/home/%user%/tmp:/var/www/html:/etc/phpmyadmin:/var/lib/phpmyadmin:/etc/roundcube:/var/lib/roundcube:/tmp:/bin:/usr/bin:/usr/local/bin:/usr/share:/opt
20+
;php_admin_value[open_basedir] = /home/%user%/web/%domain%/public_html:/home/%user%/web/%domain%/public_shtml:/home/%user%/tmp:/tmp:/bin:/usr/bin:/usr/local/bin:/usr/share:/opt
2121
;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f admin@%domain%
2222

2323
;env[HOSTNAME] = $HOSTNAME

‎install/deb/templates/web/php-fpm/socket.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ pm.status_path = /status
1717

1818
php_admin_value[upload_tmp_dir] = /home/%user%/tmp
1919
php_admin_value[session.save_path] = /home/%user%/tmp
20-
php_admin_value[open_basedir] = /home/%user%/web/%domain%/public_html:/home/%user%/web/%domain%/public_shtml:/home/%user%/tmp:/var/www/html:/etc/phpmyadmin:/var/lib/phpmyadmin:/etc/phppgadmin:/etc/roundcube:/var/lib/roundcube:/tmp:/bin:/usr/bin:/usr/local/bin:/usr/share:/opt
20+
php_admin_value[open_basedir] = /home/%user%/web/%domain%/public_html:/home/%user%/web/%domain%/public_shtml:/home/%user%/tmp:/var/www/html:/tmp:/bin:/usr/bin:/usr/local/bin:/usr/share:/opt
2121
php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f admin@%domain%
2222

2323
env[HOSTNAME] = $HOSTNAME

0 commit comments

Comments
 (0)