4

I'm setting up a new server and I'm in doubt whether I install php/apache with SuPhp or mod_ruid2. I'd a lot of troubles with SuPHP before and it's definitely slower than mod_ruid2. But is mod_ruid2 equal as secure as SuPHP? Do I have more security risks when I use mod_ruid2 than i'd have with SuPHP?

In other words: mod_ruid2 vs SuPHP. Who wins?

Improve this question

1 Answer 1

Reset to default
6

Lets deal with your security question first:

Mod_ruid2 is almost as secure as SuPHP. Both execute the scripts as a privledge isolated user. I give SuPHP the win by a wisker because it refuses to run files that are editable by everyone (666 and 777 perms), while mod_ruid2 will still execute this.

As long as you don't upload / setup insecure permissions mod_ruid2 is just as secure as SuPHP.

As for what I would use, that depends on a lot of factors. The better fit depends on more then just raw execution speed or security. You need to consider memory usage, the number of unique vhosts, etc.

mod_ruid2 is not compatible with a number of other apache modules and technologies that are also important from an overall performance perspective:

  • mod_cache (mod_disk_cache, mod_memory_cache, etc)
  • the newer apache mpms (mpm_event, mpm_worker, mpm_leader) that use threads instead of just processes.
  • FastCGI and other techniques that give you the same speed advantages as mod_ruid2.

If you are going to have a lot of different sites all doing PHP, then mod_ruid2 makes sense. If its a few sites, FastCGI makes a lot more sense.

Improve this answer
3
  • But mod_ruid2 will start as root then switch to the script owner, right (like mpm-itk)? So any vulnerability hitting before the setuid operation may allow an attacked to root the server. This don't happen with mod_php or suphp (as both run as non-root users).
    – MV.
    Mar 22, 2013 at 20:01
  • mod_ruid2 starts as the apache user, just like mod_php and it changes to the vhost owner for each vhost request (i.e. before the script is loaded)
    – n8whnp
    Mar 22, 2013 at 21:40
  • 3
    Note that development of suPHP came to a halt: See the official End of life notice.
    – xebeche
    Jan 7, 2014 at 3:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .