<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi Richard,<br>
<br>
Richard Morgan wrote:
<blockquote cite="mid:715D806AF013484E82BFC23C92C07113@morganweb"
type="cite">
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
<base
href="file://C:%5CProgram%20Files%5CCommon%20Files%5CMicrosoft%20Shared%5CStationery%5C">
<style>BODY {
BACKGROUND-REPEAT: no-repeat; FONT-FAMILY: Arial; BACKGROUND-POSITION: left top; COLOR: #000000; FONT-SIZE: 10pt
}
</style>
<meta name="GENERATOR" content="MSHTML 8.00.6001.19120">
<div>I have a question about suphp... very basic, but maybe I've
missed something and need to fill in a gap in my knowledge.</div>
<div> </div>
<div>What is the purpose of suphp? What problems do people get that
this fixes and when is it appropriate to enable this feature? As I see
it, it's super-user php; isn't that a bit risky?</div>
<div> </div>
</blockquote>
<br>
In contrary, the purpose of suphp is to run scripts with the user
privileges of the resp. site-owner and not with the privileges of the
webserver as with most php setups.<br>
Imagine you have 2 sites, both have a config file that a php script
needs to write to. If both sites run their php with webserver
privileges, both sites could alter the others sites config files just
by knowing the path to the file in question. Suphp in turn makes sure
scripts run only as the site-owner and also that only files owned by
this owner can be written to. This also makes sure that the site
running as webserver can not alter the config file of the site running
with suphp as those files do not belong the webserver but to the
siteowner of the other site.<br>
<br>
This is just one example why suphp is a very nice security addition,
but you should get the idea and google certainly will do the rest ;)<br>
<br>
So basically suphp enhances your overall webserver security
tremendously by mitigating some of the most used attack vectors. On the
other hand it can be pretty difficult to get larger php-application to
run with suphp.<br>
<br>
Cheers,<br>
Christoph<br>
</body>
</html>