0

I have LAMP stack server ( using vhost configuration for apache2). I already have site running on this server. Now I want to have another site hosted on same server.

However ,session_id and sessions in particular generated by second website should be independent of first ( existing ) website. In fact , what I am looking forward to is , both website should have not have knowledge and access to each other's session.

Is this possible to do in PHP on single apache server ? How can I achieve this isolation ?

1 Answer 1

1

I would suggest using Apache's SUExec wrapper, and mod_fastcgi (or mod_fastcgid).

mod_fastcgid is a dynamic worker pool, which executes the PHP interpreter as a specific user, and not under the web browsers user ID. this way, you can create different unix users for each website.

not only does this help separate each website, but it limits damage done by a potential break in, and also contributes to an overall elevated sense of privacy for each website.

using fastcgid, each site can have its own PHP.ini (located in the website users home directory, for example), and inside this individualized configuration you should be able to set a specific path for where to store saved sessions;

if you set this path to, for example, /home/website1/tmp/, or /home/webiste2/tmp/, each user will have their own personal path for store sessions, secured using unix file permissions.

if this is a personal server and all the websites belong to you, consider storing session cache inside a mysql DB. but this does not scale well for a multi homed server.

good luck!

3
  • Thank you for your comment. Is this any tutorial or guide/blog available on how should I change configuration and give each site its own php.ini ? I would love to try solution you mentioned.
    – Vishal
    Jun 9, 2014 at 23:46
  • if you are running Debian or Ubuntu Linux, you could take a look at this post which I have just dug up online: davejamesmiller.com/blog/installing-php-fastcgi-suexec-debian
    – RapidWebs
    Jun 11, 2014 at 0:47
  • note: this guide says to leave all files owned by the Apache user, and change PHP files to the new user you have created. instead, i recommend making ALL files owned by the websites user, adding the Apache user to your web sites user group (i.e. adding www-data to the user-group for WEBSITE1). this way, apache can access the websites files, but all other users cannot. finally, if you are not on debian or ubuntu, replace "apt-get" with your package manager
    – RapidWebs
    Jun 11, 2014 at 0:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .