Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Debian Lenny web server. It is running apache2 with libapache2-mod-suphp. Unfortunately, suphp makes impossible to use phpmyadmin, as phpmyadmin is installed in /usr/share/phpmyadmin and owned by root, and suphp disables it's engine in this direcory:

$ cat /etc/apache2/mods-enabled/suphp.conf 
<IfModule mod_suphp.c>
    AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml
    suPHP_AddHandler application/x-httpd-php
    <Directory />
        suPHP_Engine on
    </Directory>

    # By default, disable suPHP for debian packaged web applications as files
    # are owned by root and cannot be executed by suPHP because of min_uid.
    <Directory /usr/share>
        suPHP_Engine off
    </Directory>
</IfModule>

Is there a possibility to enable system phpmyadmin (may be through standard libapache2-mod-php5) while using suphp? How?

share|improve this question
add comment

2 Answers

up vote 10 down vote accepted

In /etc/apache2/mods-available/suphp.conf following two lines:

AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml
suPHP_AddHandler application/x-httpd-php

should be changed to:

AddType application/x-httpd-suphp .php .php3 .php4 .php5 .phtml
suPHP_AddHandler application/x-httpd-suphp

Then, in /etc/suphp/suphp.conf line

application/x-httpd-php=php:/usr/bin/php-cgi

should be changed to:

application/x-httpd-suphp=php:/usr/bin/php-cgi

Then, contents of /etc/apache2/mods-available/php5.conf should be changed from:

<IfModule mod_php5.c>
  AddType application/x-httpd-php .php .phtml .php3
  AddType application/x-httpd-php-source .phps
</IfModule>

to:

<Directory /usr/share>
    <IfModule mod_php5.c>
      AddType application/x-httpd-php .php .phtml .php3
      AddType application/x-httpd-php-source .phps
    </IfModule>
</Directory>

This way, all php scripts get assigned x-httpd-suphp type which is handled by suphp. As suphp is disabled for files in /usr/share, in php5.conf for this directory php scripts get type of x-httpd-php and are handled by mod_php5. This way, you retain suphp for all other scripts except for system-installed ones in /usr/share.

share|improve this answer
    
Good answer, and better than some of the more convoluted solutions that popup on Google, involving running phpmyadmin in a vhost, etc. Thanks thor. –  zlovelady Apr 1 '12 at 5:41
1  
The author of suPHP states that running mod_php and suphp at the same time is too dangerous. It allows a remote attacker to modify a targeted user's files. If you are sure it is impossible suPHP get invoked in /usr/share adn mod_php cannot be invoked outside /usr/share, then I guess this configuration is safe. Otherwise, you have created a security hole in your server. Reference: seclists.org/bugtraq/2004/Aug/att-320/suphp-advisory.txt –  MV. Jun 17 '12 at 7:41
    
@MV. How did you get it running? I'm on 12.04, added /usr/share/phpmyadmin to docroot in /etc/suphp/suphp.conf and switched the engine on in the apache config. Getting lost in what permissions to set the files, and a possible ubuntu bug with it not reading the config.inc.php so i can set the blowfish secret (yep, i found the one in /var/lib after googling in circles for hours). Do you have a blog post or some tips somewhere on the web? cheers! –  Steve Aug 19 '12 at 10:14
add comment

fwiw on ubuntu 12.04 i took the following steps: added

:/usr/share/phpmyadmin

to the end of docroot in /etc/suphp/suphp.conf

added

<Directory /usr/share/phpmyadmin>
    suPHP_Engine on
</Directory>

to /etc/apache2/mods-enabled/suphp.conf

created a new virtual host

<VirtualHost *:80>
  ServerName phpmyadmin.example.com
  DocumentRoot /usr/share/phpmyadmin
  DirectoryIndex index.php
  <Directory /usr/share/phpmyadmin>
    Options FollowSymLinks
  </Directory>
  <directory /usr/share/phpmyadmin/setup>
    Order Deny,Allow
    Deny from All
  </directory>
  <directory /usr/share/phpmyadmin/libraries>
    Order Deny,Allow
    Deny from All
  </directory>
</VirtualHost>

did

chown pmauser:pmauser /usr/share/phpmyadmin
chown pmauser:pmauser /usr/share/phpmyadmin/*.php
chmod og-r /usr/share/phpmyamdin
chmod og-r /usr/share/phpmyamdin/*.php

which gets it mostly working.

I've not been able to figure out how to get rid of the error message asking for a blowfish_secret. Ubuntu scatters the config files through several directories and their /etc/phpmyadmin/apache.conf has

php_admin_value open_basedir /usr/share/phpmyadmin/:/etc/phpmyadmin/:/var/lib/phpmyadmin/

i'm not willing to add all those paths to the suphp docroot, and pma does not recognise /usr/share/phpmyadmin/config.inc.php

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.