Welcome to your new site! If this is your first experience with A-Team's setup please take a look at the information below, it will help you get to know your new A-Team PHP-FPM Chroot environment. Remember, we're here to help! We're PHP developers ourselves so don't hesitate to give us a shout if you run into any problems or have any questions.
- Support Ticket System: https://support.ateamsystems.com/
- Support Phone: +1 877.883.1394 option 1
Self-Tests
| Test | Description | Result |
|---|---|---|
| CHRoot | CHRoot PHP-FPM pool variable is set. This is non-critical and mostly for informational purposes. |
FAILED");
printf(" Define \n\n");
}
else
{
printf("env[CHROOT]in the site pool config PASSED ");
}
flush();
?>
|
| Sessions | Attempt to start a PHP session. |
FAILED");
printf(" Exception: %s \n\n", $SessionsTestError);
}
if ( $SessionsTestRet !== TRUE )
{
printf("FAILED ");
printf("session_start() returned false. \n\n");
}
else
{
printf("PASSED ");
}
flush();
?>
|
| Sending Mail | The mail() function works. | |
| cURL HTTPS | Outgoing curl() calls work 100% securely including host verification which means cURL can find the CA Root Certificate Bundle. |
FAILED");
printf(" cURL Error: %s \n\n", curl_error($ch));
}
else
{
printf("PASSED ");
printf("External IP: %s \n\n", $result);
}
flush();
?>
|
| Cryptography | Entropy data source is suitable for cryptography. |
= 7 )
{
// -- PHP 7.x / OpenSSL
$key = "password123";
$plaintext = "testing encryption";
$cipher = "aes-128-gcm";
$ivlen = openssl_cipher_iv_length($cipher);
$iv = openssl_random_pseudo_bytes($ivlen);
$ciphertext = openssl_encrypt($plaintext, $cipher, $key, $options=0, $iv, $tag);
}
else
{
// -- PHP 5.6 / mcrypt
$td = mcrypt_module_open (MCRYPT_RIJNDAEL_256, "", MCRYPT_MODE_CBC, "");
$iv = mcrypt_create_iv (mcrypt_enc_get_iv_size ($td), MCRYPT_DEV_URANDOM);
}
restore_error_handler();
}
// ---- Process results
//
if ( $TestSuccess === FALSE )
{
printf(" FAILED ");
printf("Error: %s \n\n", $TestError);
}
else
{
printf("PASSED ");
printf("mcrypt_create_iv() uses /dev/urandom \n\n", $TestError);
}
flush();
?>
|
| Temp Files | Verify files can be written to /tmp which is needed for uploads, SOAP calls, sessions and more. |
FAILED");
printf(" %s \n\n", $TestError);
}
else
{
printf("PASSED ");
}
flush();
?>
|
| SOAP / WSDL | Verify SoapClient() can retrieve a WSDL via HTTPS. |
1, "cache_wsdl" => WSDL_CACHE_NONE, "connection_timeout" => 5 );
$SoapCall = new SoapClient($url, $params);
if ( $SoapCall == NULL )
{
$TestSuccess = FALSE;
$TestError = "SoapClient() returned NULL";
}
else
{
$SoapFunctions = $SoapCall->__getFunctions();
if ( $SoapFunctions[0] != "string sayHello2n1iC8CyyzTXuzY6wUmJ(string \$firstName)" )
{
$TestSuccess = FALSE;
$TestError = "__getFunctions() did not return correctly";
}
}
$auth_params = new STDClass();
}
catch (SoapFault $SoapError)
{
$TestSuccess = FALSE;
$TestError = "" . print_r($SoapError, TRUE) . ""; } if ( $TestSuccess === FALSE ) { printf(" FAILED ");
printf("%s \n\n", $TestError);
}
else
{
printf("PASSED ");
}
flush();
?>
|
| Zend OPcache | Verify OPcache is configured correctly PHP-FPM + chrooting. |
";
else
$TestSuccess = FALSE;
$TestError .= "Set 'opcache.validate_permission = 1' in php.ini";
}
// Show that we know it's setup right for PHP-FPM
if ( $TestSuccess != FALSE )
$TestError = "Module enabled and configured correctly";
}
else
$TestError = "Module loaded but disabled";
}
else
$TestError = "";
if ( $TestSuccess === FALSE )
{
printf(" FAILED ");
printf("%s \n\n", $TestError);
}
else
{
printf("PASSED ");
printf("%s \n\n", $TestError);
}
flush();
?>
|
| Image-Magick | Verify Image-Magick is installed and its filters/formats work. |
$FormatCount formats installed";
}
else
{
$TestError = "$FormatCount formats installed";
}
}
catch (ImagickException $IMError)
{
$TestSuccess = FALSE;
$TestError = "" . print_r($IMError, TRUE) . ""; } } if ( $PluginPresent == TRUE ) { if ( $TestSuccess === FALSE ) { printf(" FAILED ");
printf("%s \n\n", $TestError);
}
else
{
printf("PASSED ");
printf("%s \n\n", $TestError);
}
}
else
{
printf("Not Installed ");
printf("Extension pecl-imagick not installed \n\n");
}
flush();
?>
|
Things to Note
PHP-FPM with chrooting offers much better performance and security over mod_php or PHP/CGI, but there are some things to know when moving to this setup:
- If you are new to the concept of chrooting take a quick glance at the Wikipedia Chroot page for some background.
- Each site has its own process pool and associated user which its PHP code runs as inside the chroot. This site's user is .
- When using MySQL do not use localhost as the connection host, even if the MySQL server is local. MySQL co-opts this value and will switch to socket mode if localhost is passed. Since PHP cannot access files outside the chroot, it will fail to connect to the MySQL file socket. To connect to a MySQL server on the same host as PHP use 127.0.0.1 as the hostname. This ensures that the TCP connection method is used.
- Directory paths, according to PHP, are all relative of the chroot. For example, this site's documents are located in , however PHP sees this as . Make sure this is taken into account if absolute paths are being used.
- Web server (NginX or Apache) and PHP logs for this site are located in /log. PHP errors are never displayed and instead sent to the file php-errors. You can have your application write any custom logs you might have to this directory as well. All files in this directory are automatically rotated periodically.
- $_SESSION storage needs to be moved into the database. In staging and production environments the default file based session storage will not work as these are not shared between servers. What will appear to happen is that $_SESSION will vanish or fail to be set as requests are spread across all back end servers evenly. A-Team has example code and instructions on how to set this up and easily switch over with minimal changes, just ask!
- Uploads should be placed into the /htwritable directory which is outside of the public access scope. By default /htwritable, /tmp, and /log (relative to the chroot) are the only places that the user can write to, which is what this site's PHP code runs as.
- If you are using cURL be sure that host verification is enabled via curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2); as without that any secure calls are vulnerable to man-in-the-middle attacks. This is the default in PHP 5.6, and also applies to SOAP and other HTTPS-using functions.
- If permissions become an issue contact us, we can work out a secure permissions and ownership structure that works for you. Please DO NOT make anything world writable either via command line or in PHP. We scan continuously for this and will receive alerts if any file is set this way.
PHP Logging Settings
'E_ERROR', E_WARNING => 'E_WARNING', E_PARSE => 'E_PARSE', E_NOTICE => 'E_NOTICE', E_CORE_ERROR => 'E_CORE_ERROR', E_CORE_WARNING => 'E_CORE_WARNING', E_COMPILE_ERROR => 'E_COMPILE_ERROR', E_COMPILE_WARNING => 'E_COMPILE_WARNING', E_USER_ERROR => 'E_USER_ERROR', E_USER_WARNING => 'E_USER_WARNING', E_USER_NOTICE => 'E_USER_NOTICE' ); if(defined('E_STRICT')) $level_names[E_STRICT]='E_STRICT'; if(defined('E_DEPRECATED')) $level_names[E_DEPRECATED]='E_DEPRECATED'; if(defined('E_USER_DEPRECATED')) $level_names[E_USER_DEPRECATED]='E_USER_DEPRECATED'; $levels=array(); if(($value&E_ALL)==E_ALL) { $levels[]='E_ALL'; $value&=~E_ALL; } foreach($level_names as $level=>$name) if(($value&$level)==$level) $levels[]=$name; return implode(' | ',$levels); } printf("Effective logging settings for this site: %s\n", error2string(ini_get("error_reporting"))); ?>
$_SERVER
Under PHP-FPM/chrooting the $_SERVER variables can be a bit different.
- A-Team does some 'magic' in etc/fix-php-fpm.inc. This code is executed before every PHP script's code for a site. Most of this is fixing $_SERVER to what applications expect. For this site that file is located at /etc/fix-php-fpm.inc. This file is maintained by A-Team but let us know if you have any questions or concerns.
- For this site the actual PHP application server is behind front-end proxies. We do our best to rewrite $_SERVER["REMOTE_*"] and $_SERVER["SERVER_*"] variables so that the proxies are invisible to the code running on the back end servers. This means that PHP on the back end servers can still see the outside visitor's IP (instead of just the proxies) and so forth.
- Per the above, when proxied, you can still access the original pre-magic variables via $_SERVER["BACKEND_REMOTE_*"] if you wish to use information about the connection between the back end server and the proxy.
- A-Team defines $_SERVER["SITE_MODE"] which is set to either dev, staging, or prod so you can do conditional if statements to detect if the code is running in the dev, staging or production environment.
- A-Team defines $_SERVER["SERVER_FQDN"] which is set to the hostname of the server the script is currently running on. This is not to be confused with $_SERVER["SERVER_NAME"] which references the virtual host name of the web site.
- A-Team defines $_SERVER["CHROOT"] which is set to the real path that the site chroot is located under on the server. This directory is what PHP sees as the root directory.
Here is what $_SERVER looks like for this site:
OpenSSL
Ciphers:
Digests:
PHP Info
Take a look at the phpinfo() output below: