I have several sites on my server set up as virtual hosts. What are your thoughts on MPM-ITK?
Are the tradeoffs and the potential root exploit vulnerability worth the security of internal system files?
Eeeesh, Sounds Scary. I don't think I'll be using that any time soon.
This also sounds like a bit of a backwards step. I'd be interested to see how well/badly it scales. Depends at what value your security is over scalability.
I use mpm-itk on a personal web server that serves approximately 20 sites for a few friends. I've never run into an issue with it.
Another module that works similarly is mod_suexec (http://httpd.apache.org/docs/2.0/mod/mod_suexec.html).
Both modules will allow you to run packaged applications like Drupal and Wordpress without any problems. You might run into some odd issues on weird custom code -- I think (did not confirm this) that both modules execute PHP processes in a similar manner as a CGI script.
Regarding the comment about scalability, mod_suexec is a standard option for cPanel. I have seen it run on servers hosting hundreds of sites.
If you run a dedicated server and have control over all sites hosted, then you really don't have a reason to use either of these modules. However, if you have different users running their own sites, my opinion is to use one of these modules.
A client of mine a while back was using mpm-itk and it works well, however my preferred option (assuming you don't have thousands of vhosts) is mpm-peruser.
Here is the reason why :
That's the result of using ab to call a page that runs phpinfo() 1000 times (5 runs).
Here are two very good articles that cover both itk and peruser:
New add-on for Plesk panel can configure running virtual host as domain user. It works with mpm-itk or mod_ruid2.
Run PHP as User!
Compatible Plesk versions: