php jailkit shell user

Discussion in 'ISPConfig 3 Priority Support' started by tilman, May 6, 2021.

  1. tilman

    tilman Member HowtoForge Supporter

    Hi,
    I actually updated my Debian Buster (ISPConfig 3.2.4) with the official PHP repo to 7.4.18.
    The new PHP version was provided to ISPConfig.
    Added a new shell user w jailkit chroot.

    Executed jk_update -j /var/www/clients/client1/web32 after updating jk_init.ini /(see below)

    The ISPConfig Jailkit Server Config:
    Jailkit chroot home: /home/[username]
    Jailkit chroot app sections: basicshell editors extendedshell netutils ssh sftp scp groups jk_lsh mysql-client php imagemagick
    Jailkit chrooted applications: /usr/bin/convert /usr/bin/groups /usr/bin/id /usr/bin/dircolors /usr/bin/lesspipe /usr/bin/basename /usr/bin/dirname /usr/bin/nano /usr/bin/pico
    Jailkit cron chrooted applications: /usr/bin/php /usr/bin/perl /usr/share/perl /usr/share/php
    Jailkit authorized_keys template: /root/.ssh/authorized_keys
    Hardlinks within Jailkit chroot: Allow hardlinks

    The site, the shell user is created for, is configured for PHP 7.4

    php version output from a shell user:
    php -v
    PHP Warning: PHP Startup: Unable to load dynamic library 'imagick.so' (tried: /usr/lib/php/20180731/imagick.so (/usr/lib/php/20180731/imagick.so: cannot open shared object file: No such file or directory), /usr/lib/php/20180731/imagick.so.so (/usr/lib/php/20180731/imagick.so.so: cannot open shared object file: No such file or directory)) in Unknown on line 0
    PHP Warning: PHP Startup: Unable to load dynamic library 'soap.so' (tried: /usr/lib/php/20180731/soap.so (/usr/lib/php/20180731/soap.so: cannot open shared object file: No such file or directory), /usr/lib/php/20180731/soap.so.so (/usr/lib/php/20180731/soap.so.so: cannot open shared object file: No such file or directory)) in Unknown on line 0
    PHP 7.3.28-1+0~20210503.84+debian10~1.gbp6819da (cli) (built: May 3 2021 11:59:15) ( NTS )
    Copyright (c) 1997-2018 The PHP Group
    Zend Engine v3.3.28, Copyright (c) 1998-2018 Zend Technologies
    with Zend OPcache v7.3.28-1+0~20210503.84+debian10~1.gbp6819da, Copyright (c) 1999-2018, by Zend Technologies

    Relevant parts of /etc/jailkit/jk_init.ini

    comment = default php version and libraries
    paths = /usr/bin/php
    includesections = php_common, php7_4

    [php_common]
    comment = common php directories and libraries
    # notice: potential information leak
    # do not add all of /etc/php/ or any of the fpm directories
    # or the php config (which includes custom php snippets) from *all*
    # sites which use fpm will be copied to *every* jailkit
    paths = /usr/bin/php, /usr/lib/php/, /usr/share/php/, /usr/share/zoneinfo/
    includesections = env, logbasics, netbasics

    [php7_4]
    comment = php version 7.4
    paths = /usr/bin/php7.4, /usr/lib/php/7.4/, /usr/lib/php/20190902/, /usr/share/php/7.4/, /etc/php/7.4/cli/, /etc/php/7.4/mods-avail$
    includesections = php_common


    Qs:
    Why are some libs not found?
    Where do these folderes like /usr/lib/php/20180731 come from?
    What is needed to get PHP 7.4 running for the specified site?

    Thks. in advance for your time.

    BR
    Tilman
     
  2. Jesse Norell

    Jesse Norell Well-Known Member Staff Member Howtoforge Staff

    This is an inaccurate statement, as the php version in the official debian repo is 7.3, not 7.4. Additional versions including 7.4 are available in the sury.org repo.
    The php interpreter in the jail (version 7.3) is trying to load those modules, but the files were not copied into the jail.
    That one specifically will be from various php 7.3 related packages. The other dates are for other php versions.
    php7.4 may actually work, as you have the 'php7_4' section in your jail; try running /usr/bin/php7.4. There is currently no means to use a different php version as /usr/bin/php inside a jail, the system default (which is 7.3 on your system) is /usr/bin/php inside the jail as well.
     
  3. tilman

    tilman Member HowtoForge Supporter

     
    Last edited: May 7, 2021
  4. atle

    atle Member HowtoForge Supporter

    The sury.org repo works with jailed accounts, at least on servers installed with the auto install script. All php versions are available and can be set with the ispc gui.
     
  5. atle

    atle Member HowtoForge Supporter

    hm, maybe I misunderstood you. Are you referring to cli? If that the case I've had to remove the jail if other php versions are needed, for cron for example.
     
  6. tilman

    tilman Member HowtoForge Supporter

    Ok, might be, I have to provide some clarification.
    The main problem is, that the shell user (chroot, jailkit) does not get a working php 7.4 environment, even if it is properly configure in ISPConfig and seen by any user not chrooted.
     
  7. atle

    atle Member HowtoForge Supporter

    Yes this is my experience as well, only the native php version is available for jailed shell users, that is 7.3.
     
  8. tilman

    tilman Member HowtoForge Supporter

     
  9. atle

    atle Member HowtoForge Supporter

    Yes to sites, yes, but not on user level.
     
  10. till

    till Super Moderator Staff Member ISPConfig Developer

    The PHP version selector is for the website PHP only, it is not about PHP version in a jailed shell user. You can configure which PHP versions are available for shell users under System > Server config > jailkit.
     
    ahrasis likes this.
  11. atle

    atle Member HowtoForge Supporter

    Yes that worked, splendid .
     
  12. atle

    atle Member HowtoForge Supporter

    However, N.B., with a limited config, not the same modules as the un-jailed php version.
     
  13. nhybgtvfr

    nhybgtvfr Well-Known Member HowtoForge Supporter

    you can select the php versions to include in the jailkit, in the main jailkit settings, or by adding the section in the website options.
    you can assign multiple php versions to a jailkit, by adding the relevant php section, eg: php_7.3 php_7.4 php_8.0
    you can't, however, just expect to use /usr/bin/php and get php7.4 or php8.0 when the system default php is php7.3
    you would have to specify the exact php version you want to use, eg
    Code:
    /usr/bin/php7.4 /web/randomscript.php" 
    or you can ssh in as the jailkit user and create, if it doesn't exist, a .bashrc file in your home folder, and create an alias in that, eg
    Code:
    alias php='/usr/bin/php7.4'
    this way, multiple ssh users on the same website can each have their own login, and use different versions of php to each other, whilst still all using the same /usr/bin/php command. (you'll have to run 'source .bashrc' or logout and log back in for it to take effect)
     
    topogigio, Jesse Norell and ahrasis like this.

Share This Page