Multi hosts (vhosts) and Doc

[CarlUman]

Have a few security questions on apache and php with multiple domains.
I currently have in apache2.conf and commonapache2.conf

[adaptr]

It means, simply put, that any request that ends up at your IP for which there is no virtual host will get directed to the base documentroot - probably not what you want.

You can circumvent this in two ways:

1. set your base document root to an unused directory somewhere, say /www/baseroot, possibly only providing a simple page that tells people there is nohing there... or
2. you can set up a _default_ virtualhost; this will receive all requests for nonexistent virtualhosts. See the apache docs at httpd.apache.org for how.

This does include somebody requesting your IP address, so it is rather important that you set this up properly.

As you probably already surmised, the way you have this set up currently means that anybody requesting your IP directly has access to all virtualhosts.

As for php virtualhosts with different php.ini files - you can of course reset the php config for every virtualhost; almost any global directive is valid inside a virtualhost block.

I'm personally not that sure using php's documentroot is of much use; it tends to be sufficiently locked down when you use apache's directory permissions.
But if you want maximum security - go for it.
_________________
>>> emerge (3 of 7) mcse/70-293 to /
Essential tools: gentoolkit eix profuse screen