Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a Debian virtual machine server which I have full control over, but I have someone who wants to host a single domain on it. This is obviously a security concern, as even if his particular user cannot read all of the other domain's files, any script he runs (PHP) on the webserver can. To illustrate:

% ls -l /srv
drwxr-x--x 5 admin    admin    4096 Mar  4 13:29
drwxr-x--x 4 bob      bob      4096 Apr  4 12:41
$ su - bob
$ ls /srv/
ls: cannot open directory /srv/: Permission denied
$ ls -R /srv/




$ cat /srv/

echo shell_exec('whoami');

echo shell_exec('ls /srv');

Which outputs in a browser: www-data not very desirable.

So I decided to use FastCGI and Suexec to make sure bob's PHP files were executed as him. I was mostly following the instructions given here, but I already have a mass-hosting Apache configuration all set up.

In sites-enabled I have this configuration file called zz-mass-hosting:

NameVirtualHost my.ip.address:80

<VirtualHost my.ip.address:80>
    <Directory "/srv">
        AllowOverride all

    AddHandler cgi-script .cgi
    UseCanonicalName        Off

    VirtualDocumentRoot     /srv/%0/public/htdocs/
    VirtualScriptAlias      /srv/%0/public/cgi-bin/

    SetVirtualDocumentRoot on


Which works great.

So, for setting up this domain,, specifically I installed through apt: libapache2-mod-fcgid apache2-suexec-custom php5-cgi

I modified /etc/apache2/suexec/www-data to read: /srv. With no second line. And created /etc/apache2/conf.d/php5-fastcgid.conf:

AddType application/x-httpd-php .php

AddHandler php-fcgi .php
Action php-fcgi /fcgi-bin/php5-fcgi

Alias /fcgi-bin/ /home/www-data/

<Location /fcgi-bin/>
        SetHandler fcgid-script
        Options +ExecCGI

/home/www-data/php5-fcgi is:

exec /usr/bin/php5-cgi

with ownership www-data:www-data. I created /home/www-data/bob with ownership bob:bob and copied php5-fcgi there.

I then created in sites-available:

<VirtualHost my.ip.address:80>


             Alias /fcgi-bin/ /home/www-data/bob/
             SuexecUserGroup bob bob

             DocumentRoot /srv/

             <Directory /srv/>
                        Options Indexes FollowSymLinks
                        AllowOverride None
                        Order allow,deny
                        allow from all


But when I activate this site, and go to it still says it is running as www-data. Can anyone see where I am going wrong?

share|improve this question

1 Answer 1

Most probably ut's because by default the suexec root from debian is compiled with /var/www and you are trying to use of at /srv. See also: How to change suexec root directory from "/var/www" to "/home"?

share|improve this answer
I thought apache2-suexec-custom was meant to solve that. "I modified /etc/apache2/suexec/www-data to read: /srv" – fophillips Apr 8 '13 at 14:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.