[Solved] LiteSpeed, mod_lsapi, CloudLinux, opcache security setting?

[Mark Krieger]

Does anyone know if this https://ma.ttias.be/mitigating-phps-long-standing-issue-opcache-leaking-sensitive-data/ is a current security issue with mod_lsapi as well and if these recommended settings should be made?

Thanks
Mark

 

[Pong]

As the article states, it has been fixed by PHP. You can also try set value yourself in php.ini.

 

[Mark Krieger]

Hi Pong

It does say that it is fixed IF the additional settings are made MANUALLY in the settings. Not with the default configuration.
Now - it seems like these settings may introduce some additional overhead into the system for each script call.
And so the question stays - is it necessary in a LiteSpeed, mod_lsapi, CloudLinux environment to make these settings or are the users somehow isolated by the way PHP is run in such an environment?

 

[skhristich]

Hello Mark
To help you with this question we need a little bit more information, please create a ticket here https://cloudlinux.zendesk.com/hc/en-us/requests/newand technical experts will help you asap.

 

[Mark Krieger]

Hi Skhristich

Thanks for reaching out. I actually had also a request at CloudLinux as well and got the answer there by now

We recommend to set such values of variables :
opcache.validate_permission=1
opcache.validate_root=0

Thanks
Mark