Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have several sites on my server set up as virtual hosts. What are your thoughts on MPM-ITK?

Are the tradeoffs and the potential root exploit vulnerability worth the security of internal system files?

http://mpm-itk.sesse.net/

share|improve this question
add comment

4 Answers

New add-on for Plesk panel can configure running virtual host as domain user. It works with mpm-itk or mod_ruid2.

Run PHP as User!

Compatible Plesk versions:

  • Plesk 8 for Linux
  • Plesk 9 for Linux
  • Plesk 10 for Linux
share|improve this answer
add comment

A client of mine a while back was using mpm-itk and it works well, however my preferred option (assuming you don't have thousands of vhosts) is mpm-peruser.

Here is the reason why :

  • mpm-itk: average of 37.01 seconds
  • mpm-peruser: average of 6.95 seconds
  • mpm-prefork: average of 6.51 seconds

  • suphp: average of 164.677 seconds

  • mod_php: average of 6.422 seconds

  • suexec: average of 127.219 seconds

  • mod_php: average of 3.753 seconds

That's the result of using ab to call a page that runs phpinfo() 1000 times (5 runs).

Here are two very good articles that cover both itk and peruser:

share|improve this answer
add comment

Eeeesh, Sounds Scary. I don't think I'll be using that any time soon.

mpm-itk is based on the traditional prefork MPM, which means it's non-threaded.

This also sounds like a bit of a backwards step. I'd be interested to see how well/badly it scales. Depends at what value your security is over scalability.

share|improve this answer
add comment
up vote 0 down vote accepted

I use mpm-itk on a personal web server that serves approximately 20 sites for a few friends. I've never run into an issue with it.

Another module that works similarly is mod_suexec (http://httpd.apache.org/docs/2.0/mod/mod_suexec.html).

Both modules will allow you to run packaged applications like Drupal and Wordpress without any problems. You might run into some odd issues on weird custom code -- I think (did not confirm this) that both modules execute PHP processes in a similar manner as a CGI script.

Regarding the comment about scalability, mod_suexec is a standard option for cPanel. I have seen it run on servers hosting hundreds of sites.

If you run a dedicated server and have control over all sites hosted, then you really don't have a reason to use either of these modules. However, if you have different users running their own sites, my opinion is to use one of these modules.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.