I've been reading the php-fpm documentation and found out that I can give each socket its own user, group and mode, but how can I tell apache (per vhost I mean) to use x user and y group to connect to the sockets?

What I want to achieve is to prevent pools from reading each other files, in case of breach, only the files for that domain would be leaked and nothing else. I know how I can do this for the fpm pools using the user and group settings and then giving the file structure their proper permissions. But what about the same http user being able to access all fpm sockets? Should I be concerned about that or not?

pool1.conf (php-fpm)

user = domain1
group = domain1
listen = /run/php-fpm/www.domain1.sock
listen.owner = http
listen.group = http
listen.mode = 0660

domain1.conf (apache virtual host)

<VirtualHost *:443>
    ServerAdmin webmaster@domain1.com
    ServerName www.domain1.com

    DocumentRoot "/srv/http/domain1.com/www"
    <Directory "/srv/http/domain1.com/www">
        <IfModule dir_module>
            DirectoryIndex index.php

        <Files "index.php">
            SetHandler "proxy:unix:/run/php-fpm/www.domain1.sock|fcgi://localhost/"

        <IfModule mod_rewrite.c>
            RewriteEngine On
            RewriteRule ^index\.php$ - [L]
            RewriteRule . index.php [L]

    SSLEngine On
    SSLCertificateFile "/etc/letsencrypt/live/domain1.com/fullchain.pem"
    SSLCertificateKeyFile "/etc/letsencrypt/live/domain1.com/privkey.pem"
    Protocols h2 h2c
    Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"
    ErrorLog "/srv/protected/sites/domain1.com/logs/www-error_log"
    CustomLog "/srv/protected/sites/domain1.com/logs/www-access_log" common

I'm also trying to figure out why does the default value for listen.mode is 0660? Why does the http group need read+write permissions?


I'm not an expert but here's how I understand it to work. Each process runs as a system (service) user. Apache is a process and runs as its user (http in your example). I think that in order to achieve what you want you would need to spawn a separate apache process with its own user.

To do this, though, you'd also need to put each user/site on its own port and then have a reverse proxy on the same machine that listens on port 80/443 and accesses the corresponding sites accordingly.

This is actually not a bad setup as it also gives you the opportunity to add mod_security on the proxy server and cover all sites at once.

So, in short, PHP-FPM is not the solution you are looking for (if I've understood your question correctly). The listen.user directive must be the same as the user that apache is running as.

  • Yes, I know, I have as many sockets as pools but that's not the problem. What I'm asking here is how can I make httpd user different users/groups to read the sockets. httpd uses the http user/group, but i want different users, preferably the same user/group the php-fpm pools are using. – Chazy Chaz Nov 21 '18 at 20:40
  • I added clarification about how to change the user. Please let me know if it is still not clear. – Ted Stresen-Reuter Nov 23 '18 at 11:35
  • Yes it is clear, but again, that's what I already had working (did you read my original post? right below pool1.conf I'm already doing that). I don't want php-fpm to create all sockets with the same user/group and I can only tell php-fpm to use different user/group if I can make the apache virtualhosts use different user/group to read the sockets. So the problem here is apache, does apache supports doing this? maybe through modules? That would be a proper answer. – Chazy Chaz Nov 23 '18 at 19:23
  • Sorry. Updated answer. I honestly hadn't understood what you were asking. – Ted Stresen-Reuter Nov 25 '18 at 13:47

maybe apache2-mpm-itk would do it https://cloudkul.com/blog/apache-virtual-hosting-with-different-users/

  • Whoa, mpm-itk is still alive? Official site says not updated since 2016. I doubt it is good idea to use a web server module which requires running as root and which wasn't updated for 5 years. – Nikita Kipriyanov Feb 15 at 19:35
  • Wouldn't recommend mpm-itk, doesn't fork processes like other mpm modules (despite the name) – Laice Mar 12 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.