I am in the process of writing a PHP script that will add IP address blocks to the .htaccess
file. My concern is that I do not want to have the .htaccess
file open to the web server user for general writing, as then any compromise of the web server would allow them to write anything they like to the .htaccess
file. So I am trying to find a way to limit the PHP script to only be able to write what I want it to be able to, in some way.
I am thinking that an appropriate way to do this may be to create a script in another location, perhaps owned by root, that has suid
set on it (my web partition does not allow suid
). I can then call the script from my PHP script, and it will only be able to do what the interface of that intermediary script makes available to it, which would be to take the parameters necessary for writing the specific IP address blocking code to the .htaccess
file, and nothing else.
Does this sound like the best way to approach it? Is there any other way that would be better, or any consideration I'm missing?
Meta Note: I considered the Information Security site or Stack Overflow for this question. If it would be better on one of those please let me know.
setuid
bit on interpreted executables, so you'd need to either 1) write your block-writer in something that compiles (e.g. C or Haskell), or 2) change this default behavior