Secure PHP on IIS 8.5

Question

I'm using IIS 8.5 on Windows Server 2012 R2 to host ASP.NET and also PHP-Applications. Because there are a few different PHP-Apps, I want to restrict the access by using open_basedir. The problem: With the IIS PHP-Manager it's not possible to use a different php.ini file per vHost. So I found a custom solution: After PHP Manager has added the assignment of the php-handler, I modified the executable file as follow:

"C:\Program Files (x86)\PHP\v5.4.26\php-cgi.exe"|-c D:\Sites\my-domain.com

This is working, the vHost is using the php.ini file D:\Sites\my-domain.com\php.ini. But this solution looks a bit dirty to me. Is there a better way of setting a single php.ini file for each vHost?

have you taken a look at this, it's probably the best way to achieve that on IIS http://www.iis.net/learn/application-frameworks/install-and-configure-php-on-iis/enable-per-site-php-configuration-on-iis-60-and-iis-7-and-above — ahmelsayed, May 15 '14 at 02:22

Jan Reilink · Answer 1 · 2016-09-26T12:57:28.183

+1 for @ahmelsayed his answer. But you can create multiple FastCGI applications in IIS, with different php.ini files easily with Appcmd. But only one handler/php.ini per application pool, see:

Set up two FastCGI applications:

Appcmd.exe set config /section:system.webServer/fastCGI
/+"[fullPath='c:\php5\php-cgi.exe', arguments='-c c:\php5\php.site1.ini'], 
maxInstances='0', idleTimeout='300', activityTimeout='70', 
requestTimeout='90', instanceMaxRequests='9999', 
protocol='NamedPipe', flushNamedPipe='False']" /commit:apphost

Appcmd.exe set config /section:system.webServer/fastCGI
/+"[fullPath='c:\php5\php-cgi.exe', arguments='-c c:\php5\php.site2.ini', 
maxInstances='0', idleTimeout='300', activityTimeout='70', 
requestTimeout='90', instanceMaxRequests='9999', 
protocol='NamedPipe', flushNamedPipe='False']" /commit:apphost

Each web site then can have its own Handler for .php, pointing to one of the php.ini files:

AppCmd.exe set config "site1.com" /section:system.webServer/handlers 
  "-+[name=`'PHP`',
    path=`'*.php`',
    verb=`'*`',
    modules=`'FastCgiModule`',
    scriptProcessor=`'c:\php5\php-cgi.exe|-c c:\php5\php.site1.ini`',
    resourceType=`'File`',
    allowPathInfo=`'true`',
    requireAccess=`'Script`']"

AppCmd.exe set config "site2.com" /section:system.webServer/handlers 
  "-+[name=`'PHP`',
    path=`'*.php`',
    verb=`'*`',
    modules=`'FastCgiModule`',
    scriptProcessor=`'c:\php5\php-cgi.exe|-c c:\php5\php.site2.ini`',
    resourceType=`'File`',
    allowPathInfo=`'true`',
    requireAccess=`'Script`']"

If you don't like the command line, you can click your way through IIS Manager of course :) BTW, assuming correct configured application pool identities and NTFS file permissions, I believe there is no need for open_basedir.

Edit: Two references: https://www.saotn.org/php-wincache-on-iis/ and https://www.saotn.org/custom-php-version-iis-express-webmatrix3/ to show how to add multiple FastCGI + PHP applications in IIS.

Secure PHP on IIS 8.5

1 Answers1