Tag Info

Hot answers tagged

12

Using suexec and suphp enforce a different type of privilege separation than the default. The default is to separate the user's permission from the web server. That is, the user owns the files, and he has to grant the web server permission to view and change them. The suexec/suphp model is that the webserver (when running scripts) runs under the user's ...


10

In /etc/apache2/mods-available/suphp.conf following two lines: AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml suPHP_AddHandler application/x-httpd-php should be changed to: AddType application/x-httpd-suphp .php .php3 .php4 .php5 .phtml suPHP_AddHandler application/x-httpd-suphp Then, in /etc/suphp/suphp.conf line ...


7

It starts php processes as the owner of the .php being executed. Apache + php by default are running as a pre-defined user in the apache config. (typically www-data, apache or httpd). If you have files that are owned by a specific user, or want to setup distinct permissions for multiple users' sites... you can create a user for each site, and set ...


6

PHP-FPM is a patch for PHP to provide some advanced process management features which are useful when used in its FastCGI variant. On a side note, PHP 5.4 will probably include PHP-FPM out of the box (according to Antony Dovgal). Since mod_fcgid doesn't support externally spawned FastCGI servers, you need to use mod_fastcgi or mod_proxy_fcgi. Google found ...


3

Running PHP via FastCGI will certainly give you the most flexibility. Not only can you safely use an mpm-worker Apache, you can even use another webserver altogether (e.g. nginx). But even when staying with Apache, "PHP via FastCGI" is at the moment not one option, but at least two: mod_fastcgi, mod_fcgid. On top of that, you can either use dynamic, static, ...


3

I believe your suphp configuration file is possibly missing a logfile statement which states where logging information is stored. Based on their documentation this should be configurable with variable definitions. Further info should be found here : http://www.suphp.org/DocumentationView.html?file=CONFIG


3

I'm not sure if this will still fit with your plan, but; The easiest way to achieve this, is probably with the userdir-directive. It also makes it possible to put each users webroot in a subdirectory of their home directory - so they don't have to expose all their files on the webserver. Check out the documentation for userdir here: ...


3

are you the only user on the server? Do you host for other people/accounts? Can people upload php scripts to be run on your server? If the answer any of the above is Yes, then using something SuPHP is recommended, since it offers an extra layer of protection by forcing it to run as the user, as opposed to the user the webserver runs as. If you remove ...


3

Your question is not completely clear. If I get it: So is there anyway to upload file with account owner under mod_php(php5_module)? No. You can run Apache as a particular user, but then all scripts will run at them (including all PHP ones), which probably isn't what you want. If you want to have PHP scripts run as their respective user, you'll need ...


3

Register Globals is no longer part of PHP, and for extremely good reasons. You need to push this back to your client and tell them to sort their site out. Here is a link with a little more info: http://php.net/manual/en/security.globals.php (Note that they were deprecated in 2009)


3

suphp is not the same thing as PHP, there are a number of functional differences. Running a standard CGI interface is much slower than fastCGI / webserver module. AFAIK suphp does not support fastCGI - but there is now an apache module version. It does provide some security tweaks that are not available in the standard PHP, however the latter is not exactly ...


2

Summary of TroubleShooting steps The "U=instijl" shown from your /var/log/exim/mainlog excerpt tells you that whatever is sending the emails is running as user instijl. First see if the user is logged in with a shell. Second use 'ps aux' to find if any processes are running by that user. Third, look in your apache access logs to see what traffic is being ...


2

It appears that your VPS was preinstalled with various scripts which are useful for providing shared web hosting services. Among these are cPanel and suPHP. While these can be convenient to use, if you aren't actually providing shared web hosting and you're the only person using the machine, then they're mostly redundant and unnecessary. SuPHP, in ...


2

Here is my experience, this depends on configuration. PHP files can be set to 600, so that user can read and write them, and suPHP should take care of setting the user to the website owner. You may want to make sure that owner has been set to the user, as old installations could have an owner like www-data. You could set them 400 also, but may have user ...


2

Yes you can use suhosin with suPHP. I think by default the configuration is in /etc/php5/cgi/conf.d/suhosin.ini (at least it is in debian 6). When PHP is run by suPHP, it still try to read its configuration from the default location(s), unless you have set the "suPHP_ConfigPath" option, which overrides the default. In that case suPHP_ConfigPath points to ...


2

Those are not really "6 PHP Types", rather two PHP types, each running in 3 different Apache implementations. suphp, suphp_worker and suphp_event suPHP itself is a wrapper for PHP, running PHP under given user rights (eg differing from the rights Apache runs under) plus an Apache module (mod_suphp) which allows you to run suPHP - basically in a CGI mode. ...


2

I was able to accomplish what I was after by putting php_admin_flag engine Off at the top of the mod_suphp.c. Also I had to make sure I used suPHP_Engine off by default. End result: <IfModule mod_suphp.c> <Directory /home/> php_admin_flag engine Off AddType application/x-httpd-php .php .php3 .php4 ...


2

That output shows you have both the DSO PHP module enabled as well as the SuPHP module, so which parser is running your scripts depends on your Apache configuration. Specifically, this is defined by the AddHandler directive. You can check your phpinfo() for the defined Server API and if it says CGI then based on the information you've provided, you're ...


2

Not really answering your question, but I do not get this thing about FastCGI being difficult to configure. It is different that the other methods it should replace (mod_php, mod_python,...) so it may require rewriting a portion of the code. That can be the hard part, but for configuring Apache, at least, I find it is a cinch. As an example, I was testing a ...


1

A good candidate is: The Apache 2 ITK MPM apache2-mpm-itk (just mpm-itk for short) is an MPM (Multi-Processing Module) for the Apache web server. mpm-itk allows you to run each of your vhost under a separate uid and gid — in short, the scripts and configuration files for one vhost no longer have to be readable for all the other vhosts. ...


1

It require you to be a experienced linux administrator to following the link http://httpd.apache.org/docs/1.3/suexec.html#install Otherwise, I strongly recommend you to ask GoDaddy support to do the job for you. Submit a support ticket there.


1

suPHP requires 644 permissions on files and 755 permissions on folders or apache will throw a 500 error. Hostgator should be using cPanel which would allow you to create addon-domains under your cPanel->Addon domains option. This would be ideal for adding domains to your account. SuPHP differs from DSO as it REQUIRES your user to call files instead of ...


1

It depends on the ownership of the file/directory. Just remember, PHP under suPHP will access PHP scripts as the owner user, and those PHP scripts will operate as that user, meaning, everything they read or write is done as that user. So, PHP scripts only need to be owner-readable to run. However, anything else not being a PHP script is accessed as the ...


1

According to the Apache documentation, AddHandler/AddType can be used in a directory context which means you should be able to simply do something like the following in the Apache config: LoadModule php5_module modules/libphp5.so LoadModule php4_module modules/libphp4.so AddHandler php5-script .php AddType text/html .php <Directory /home/somedir> ...


1

First the following should be a (virtual)host in apache: <VirtualHost 192.168.1.8:80> DocumentRoot /home </VirtualHost> To serve a page Apache needs read rights to the file it is trying to access. The simplest way to achieve what you are trying is would be run as root: # find /home -type d -exec chmod 755 {} \; # find /home -type f ...


1

The usual way is to run Apache as user wwww-data (or web or www, depending on the distribution), and likely the user Apache in your case, so I would use the second option. What distribution are you using? Beside the envvars method, you can specify the user in Apache's config files as well.


1

suPHP is likely not installed. Since you are using conditional load statements, suPHP may have been removed on an Apache upgrade. I don't work on DirectAdmin boxes any longer, but I know they used to be problematic with overwriting custom configurations. Confirm that suPHP is indeed installed in Apache. Use: httpd -l to list built-in apache ...


1

Lets deal with your security question first: Mod_ruid2 is almost as secure as SuPHP. Both execute the scripts as a privledge isolated user. I give SuPHP the win by a wisker because it refuses to run files that are editable by everyone (666 and 777 perms), while mod_ruid2 will still execute this. As long as you don't upload / setup insecure permissions ...


1

PIDs are generated sequentially and before being assigned to a process a check is made to ensure a process doesn't currently have a particular PID. When pid_max is reached the counter simply wraps back to the beginning. If there are no more PIDs available then no more proceses can be created and you'll get an error message "...No more processes."


1

Without knowing about any other in built method, I think your best bet would be to write a page that allows users to modify only the values you want them to. This way, not only can you control which settings they can change, but also limit the values to your own preferences. E.g. only allow upload_max_filesize to be between 16M and 25M.



Only top voted, non community-wiki answers of a minimum length are eligible