I'm setting up a new server and I'm in doubt whether I install php/apache with SuPhp or mod_ruid2. I'd a lot of troubles with SuPHP before and it's definitely slower than mod_ruid2. But is mod_ruid2 equal as secure as SuPHP? Do I have more security risks when I use mod_ruid2 than i'd have with SuPHP?

In other words: mod_ruid2 vs SuPHP. Who wins?

1 Answer 1


Lets deal with your security question first:

Mod_ruid2 is almost as secure as SuPHP. Both execute the scripts as a privledge isolated user. I give SuPHP the win by a wisker because it refuses to run files that are editable by everyone (666 and 777 perms), while mod_ruid2 will still execute this.

As long as you don't upload / setup insecure permissions mod_ruid2 is just as secure as SuPHP.

As for what I would use, that depends on a lot of factors. The better fit depends on more then just raw execution speed or security. You need to consider memory usage, the number of unique vhosts, etc.

mod_ruid2 is not compatible with a number of other apache modules and technologies that are also important from an overall performance perspective:

  • mod_cache (mod_disk_cache, mod_memory_cache, etc)
  • the newer apache mpms (mpm_event, mpm_worker, mpm_leader) that use threads instead of just processes.
  • FastCGI and other techniques that give you the same speed advantages as mod_ruid2.

If you are going to have a lot of different sites all doing PHP, then mod_ruid2 makes sense. If its a few sites, FastCGI makes a lot more sense.

  • But mod_ruid2 will start as root then switch to the script owner, right (like mpm-itk)? So any vulnerability hitting before the setuid operation may allow an attacked to root the server. This don't happen with mod_php or suphp (as both run as non-root users).
    – MV.
    Mar 22, 2013 at 20:01
  • mod_ruid2 starts as the apache user, just like mod_php and it changes to the vhost owner for each vhost request (i.e. before the script is loaded)
    – n8whnp
    Mar 22, 2013 at 21:40
  • 3
    Note that development of suPHP came to a halt: See the official End of life notice.
    – xebeche
    Jan 7, 2014 at 3:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.