Tag Info

Hot answers tagged

12

Using suexec and suphp enforce a different type of privilege separation than the default. The default is to separate the user's permission from the web server. That is, the user owns the files, and he has to grant the web server permission to view and change them. The suexec/suphp model is that the webserver (when running scripts) runs under the user's ...


6

PHP-FPM is a patch for PHP to provide some advanced process management features which are useful when used in its FastCGI variant. On a side note, PHP 5.4 will probably include PHP-FPM out of the box (according to Antony Dovgal). Since mod_fcgid doesn't support externally spawned FastCGI servers, you need to use mod_fastcgi or mod_proxy_fcgi. Google found ...


5

This warning comes up because you define a NameVirtualHost for 12.345.67.89:443 but there is no <VirtualHost 12.345.67.89:443>. So, change to NameVirtualHost *:443, it will go away.


5

Yum/apt-get just cheats the system This is utter nonsense. Tools like these are the only sensible option to manage software installations. After they did their work (with useful default configurations), you can configure the installed software exactly like you need it. To learn how the system really works, have a look at Linux from Scratch.


4

There are (usually default) security restrictions in place inside php.ini to prevent scripts from using too much memory, executing certain functions or generally doing what they shouldn't. If you allow PHP to execute a shell script which isn't restricted in this manner, you're opening up the possibilities for attackers. For instance, they could run a fork ...


4

You're using ubuntu. Therefore recompile is pretty simple. Add source repository to your /etc/apt/sources.list . For 12.04 run echo "deb-src http://de.archive.ubuntu.com/ubuntu/ precise main"|sudo tee -a /etc/apt/sources.list change de.archive.ubuntu.com to whatever country you're in. After that update your repository. apt-get update Change dir and ...


3

Running PHP under the web server's permissions isn't isn't necessarily better or worse than using SuPHP. It's just different. The first model separates the owner from the web server, while the second model separates the owner (and his PHP code) from all the other users on the machine. Using suPHP doesn't necessarily increase your overall security, it just ...


3

<Directory /srv/www/hostname/public> Order allow,deny Allow from all </Directory> That doesn't include /srv/www/hostname/fcgid-bin/; assuming there's no Allow applying to it elsewhere in your config, this is the problem. You'll need to Allow access to this location.


3

Your question is not completely clear. If I get it: So is there anyway to upload file with account owner under mod_php(php5_module)? No. You can run Apache as a particular user, but then all scripts will run at them (including all PHP ones), which probably isn't what you want. If you want to have PHP scripts run as their respective user, you'll need ...


2

Yes, it would. suPHP and/or using FastCGI would also work. On a more general note, I'd be very wary about the coding practices (especially around security) of anyone who thought that chmod 0777 was the solution to a permissions problem. You might be installing an invitation to a giant pwn party on your server.


2

Tomcat only runs as a single (multi-threaded) process, so there's no way to have apps deployed to the same $CATALINA_BASE run as different users. You'll have to install separate Tomcat instances (or at least set up separate $CATALINA_BASE directories) if you have to run different webapps under different users. If you want to run as different users because ...


2

Trac is written in Python and supports running under mod_wsgi (per an item in the FAQ), so I'd drop several of those moving parts and switch to the fantastic mod_wsgi, which supports specifying a user for a script to run as. I use this functionality for another project and it works well. Checking for the official mod_wsgi docs, to point you at how this is ...


2

I'm using the IUS RPMs from Rackspace, and suexec came compiled and configured by default. Here are the pertinent parts of my mod_fcgid config: LoadModule fcgid_module modules/mod_fcgid.so AddHandler fcgid-script fcg fcgi fpl php DefaultInitEnv PHPRC "/etc/" FCGIWrapper /usr/bin/php-cgi .php I suggest removing the "ScriptAliasMatch" Directive and ...


2

Good question -- shows you've done your homework. I can't think of anything "obvious" that you've failed to check, so I can only give you some more advanced debugging advice. Fire up strace on the PHP process, and see exactly what it's doing under the hood. Write a bit of code that does an fopen(..., 'r') to triple-check that your directory tree ...


2

Or you can apt-get install apache2-suexec-custom after install go to cd /etc/apache2/suexec edit the file vi www-data You can see the first 2 lines, make the changes: replace /var/www with /home esc :wq after, restart apache /etc/init.d/apache2 restart


2

You don't need to recompile it. You can use this package to set a custom path on debian or ubuntu: apt-get install apache2-suexec-custom If you don't have debian or ubuntu, you have to look for such a package or recompile suexec with the right docroot (see suexec doc). The param is: --with-suexec-docroot=DIR You have to check, how to do it for your ...


1

Find the fcgid configurations with this command: /usr/lib/apache2/suexec -V -D AP_DOC_ROOT="/var/www" -D AP_GID_MIN=100 -D AP_HTTPD_USER="www-data" -D AP_LOG_EXEC="/var/log/apache2/suexec.log" -D AP_SAFE_PATH="/usr/local/bin:/usr/bin:/bin" -D AP_UID_MIN=100 -D AP_USERDIR_SUFFIX="public_html" The wrapper must be written in the directory tree of: ...


1

try /usr/sbin/apachectl -t -D DUMP_MODULES check that all modules enabled If you get Warning: SuexecUserGroup directive requires SUEXEC wrapper. Resolution Such warning is usually caused by invalid permissions on suexec wrapper, it should be: # ls -la /usr/sbin/suexec -rwsr-xr-x 1 root root 12064 2008-04-17 01:15 /usr/sbin/suexec If the permissions ...


1

As far as I know, suexec will not grant root privileges (or the privileges of the apache user). To use suexec, in its simplest form, I believe that you would: If you are running FastCGI, you will define the path to suexec (I don't believe suexec works for mod_php) (in httpd.conf): e.g. FastCgiSuexec /usr/sbin/suexec (which may require changing the ...


1

It's to do with the order of the directives. In conf/http.conf it includes conf.d/* before it specifies User and Group directives. Try putting mod_fastcgi.conf in conf/ and at the end of httpd.conf append Include conf/mod_fastcgi.conf


1

As of now, It is not possible to run a script as anything other than the user defined in the FPM pool. You would need to setup a different pool and define the other user/group. Is there some reason you can't or don't want to create separate pools? EDIT: If you are worried about wasting idle resources, there is some talk about creating an "ondemand" ...


1

I think this is what you are looking for. BTW you don't need php-fpm with mod_fastcgi And answer to your question is NO. You can't use your pool because it's already running and is running with certain user rights that couldn't be changed within FPM (by design). Just use approach I pointed to. Good luck


1

It's not ridiculous or stupid - perhaps a little crazy but anyway... you might want to look at MPM_peruser or MPM_itk which seems to have minimal performance impact and are 100% compatible with mod_php. SUEXEC require you to use PHP as a CGI and it will have performance impact on your websites ( of course it all depends how busy your websites are ...) ...


1

Error: Could not read object configuration data I seen "uid: (10011/nagiosweb) gid: (110/110) cmd: config.cgi" in my /var/log/apache2/suexec.log, and also changed /etc/nagios3/conf.d/* and /etc/nagios3/*.cfg owner user to "nagiosweb" How about the object configuration files: chown -R nagiosweb /etc/nagios3/objects


1

suExec is used to change the user under which a CGI script runs. The above notice simply tells you it is enabled. It is commonly seen as part of Apache starting for instance, when I restart apache, I get: [Thu Jul 07 22:09:41 2011] [notice] caught SIGTERM, shutting down [Thu Jul 07 22:09:43 2011] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec) ...


1

It require you to be a experienced linux administrator to following the link http://httpd.apache.org/docs/1.3/suexec.html#install Otherwise, I strongly recommend you to ask GoDaddy support to do the job for you. Submit a support ticket there.


1

Using suPHP or suEXEC (+ fcgi/cgi) is a good decision for securing your server(separate the applications). But to do this, you need to have different vhost for the each of those applications, let's say for ex.: app1.domain.com , app2.domain.com, app3.domain.com. If your site structure is like this above, there won't be a problem to setup 3 virtual hosts, ...


1

First of all, if the owner of a file doesn't need to have write access, don't give it to them. You can do this by setting the first number of the UNIX permissions. This means that only root will have write access to their files. This will be very annoying when they will need to upgrade files but you have said that they shouldn't have write access.... ...


1

Nowadays the way to go isn't apache and suexec at all. Try using lighttpd and php-fastcgi; this gives you excellent process isolation and performance: php is always running, and each user gets their own, but they don't bloat the memory of the web server itself. http://redmine.lighttpd.net/wiki/1/TutorialLighttpdAndPHP


1

I'd say you should check out 3 main lightweight servers. Each work using php-fastcgi (or something similar) and all have their pros and cons. www.cherokee-project.com www.cherokee-project.com/doc/cookbook_php.html www.cherokee-project.com/doc/cookbook_wordpress.html www.cherokee-project.com/doc/cookbook.html nginx.org wiki.nginx.org/NginxConfiguration ...



Only top voted, non community-wiki answers of a minimum length are eligible