Arch Linux

yp

Member

Registered: 2010-03-09

Posts: 5

Apache + suexec || Using php-cgi on Apache

I have an server running apache with some users that want to run websites from it. I currently have all their websites in /srv/http/name_of_website
and gave the correct users permissions to access their website's folder. Though the problem is that all the php scripts run as http instead of with the user permissions. for that I tried installing suexec though I didn't get much result from the guide on arch-wiki. Though I'm sure there are some steps missing so I'm asking for someone to help me fill in the necessary things I may be missing.

here's what I have so far:

websites are in /srv/http/name_of_website with permissions set to the user
I loaded the suexec_module  modules in the apache conf
I added in the necessary things to the website's vhosts:   SuexecUserGroup user usergroup

Now obviously that yield no results for me as I'm sure I'm missing some steps, or I did something wrong. I can really use some better guidance as I'm truly lost on this one and every other guide I look up shows me different ways/are using different setups of going at this which just confuses me more.

Can I get a nice newbie guide on what I need to do to get this working.

suexec -V shows me:

-D AP_DOC_ROOT="/srv/http"
-D AP_GID_MIN=99
-D AP_HTTPD_MIN_USER="http"
-D AP_LOG_EXEC="/var/log/httpd/suexec.log"
-D AP_SAFE_PATH="/usr/local/bin:/usr/bin:/bin"
-D AP_UID_MIN=99
-D AP_USERDIR_SUFFIX="public_html"

Last edited by yp (2010-05-28 08:05:15)

yp

Member

Registered: 2010-03-09

Posts: 5

Re: Apache + suexec || Using php-cgi on Apache

So it seems I need to run php as a cgi. I went ahead and installed php-cgi. How do get apache to run my php scripts as cgi now?

Last edited by yp (2010-05-28 07:56:16)

astacha

Member

Registered: 2009-03-04

Posts: 27

Re: Apache + suexec || Using php-cgi on Apache

Hi yp

I'm having a similar issue with wordpress.

I found this guide on enableing suexec use with php: http://alain.knaff.lu/howto/PhpSuexec/

I've got to try it out myself but it seems like it's got the answer

Alexie

kang

Member

Registered: 2010-08-07

Posts: 83

Re: Apache + suexec || Using php-cgi on Apache

You would consider using the ITK MPM, as SuExec is slow and cumbersome. ITK let you have separated per user servers easily and is patched in by default in ArchLinux.

Alternatively, if you want even more performance, you might want to use mod_rsbac (not default in ArchLinux), while more complicated, it runs on regular prefork MPM and is very fast. mod_rsbac let you separate more than just the user id, but also various other resources, and almost anything from your system in fact can be allowed or disallowed. It also ensure that if a server is compromised, the attacker is contained into it's own sandbox with access to approximately nothing except it's own server file, and write to the server log (can't even execute root commands even if he would gain root)