Suexec - Revision history

Jbroman at 19:08, 21 May 2012

2012-05-21T19:08:51Z

← Older revision		Revision as of 14:08, 21 May 2012
Line 1:		Line 1:
			This approach is not currently in use. View the history if you wish to learn about how it used to be set up.
	[http://httpd.apache.org/docs/2.2/suexec.html suexec] is used allow [[Apache]] to isolate certain sites from the rest of the system by running them as users other than www-data (for example, webmail is run as www-webmail). The global suexec configuration is /etc/apache2/suexec/www-data, and suexec logs to /var/log/apache2/suexec.log.

	== Site Setup ==

	Here's an example of what's needed to suexec isolate a specific site (this example is the setup for the [[Webmail\|webmail]]).

	'''dr-xr-xr-x 2 www-webmail www-webmail 4096 2010-01-20 21:57 /var/lib/roundcube/fcgi-wrapper'''

	'''-r-xr-xr-x 1 www-webmail www-webmail 95 2010-01-20 21:57 php-cgi'''
	#!/bin/sh
	export PHP_FCGI_CHILDREN=0
	export PHP_FCGI_MAX_REQUESTS=4000
	exec /usr/bin/php5-cgi

	'''-rwxr-xr-x 1 root root 71 2010-01-20 21:34 php-cgi-suexec'''
	#!/bin/sh
	exec /usr/lib/apache2/suexec www-webmail www-webmail php-cgi

	And here is the relevant line in the vhost configuration:

	FCGIWrapper "/var/lib/roundcube/fcgi-wrapper/php-cgi-suexec" .php

	Note: As Apache seems to hang on reload, the init.d script for Apache has been modified to kill off all processes belonging to www-wiki and www-webmail. Though not an ideal solution, this should alleviate the immediate issue.

	[[Category:Software]]		[[Category:Software]]

Jbroman: add Suexec to Software category

2010-03-22T23:16:59Z

add Suexec to Software category

← Older revision		Revision as of 18:16, 22 March 2010
Line 22:		Line 22:

	Note: As Apache seems to hang on reload, the init.d script for Apache has been modified to kill off all processes belonging to www-wiki and www-webmail. Though not an ideal solution, this should alleviate the immediate issue.		Note: As Apache seems to hang on reload, the init.d script for Apache has been modified to kill off all processes belonging to www-wiki and www-webmail. Though not an ideal solution, this should alleviate the immediate issue.

			[[Category:Software]]

Jbroman at 14:59, 28 January 2010

2010-01-28T14:59:16Z

← Older revision		Revision as of 09:59, 28 January 2010
Line 20:		Line 20:

	FCGIWrapper "/var/lib/roundcube/fcgi-wrapper/php-cgi-suexec" .php		FCGIWrapper "/var/lib/roundcube/fcgi-wrapper/php-cgi-suexec" .php

			Note: As Apache seems to hang on reload, the init.d script for Apache has been modified to kill off all processes belonging to www-wiki and www-webmail. Though not an ideal solution, this should alleviate the immediate issue.

Jbroman at 00:45, 23 January 2010

2010-01-23T00:45:41Z

← Older revision		Revision as of 19:45, 22 January 2010
Line 9:		Line 9:
	'''-r-xr-xr-x 1 www-webmail www-webmail 95 2010-01-20 21:57 php-cgi'''		'''-r-xr-xr-x 1 www-webmail www-webmail 95 2010-01-20 21:57 php-cgi'''
	#!/bin/sh		#!/bin/sh
	export PHP_FCGI_CHILDREN=3		export PHP_FCGI_CHILDREN=0
	export PHP_FCGI_MAX_REQUESTS=4000		export PHP_FCGI_MAX_REQUESTS=4000
	exec /usr/bin/php5-cgi		exec /usr/bin/php5-cgi

Jbroman at 05:08, 21 January 2010

2010-01-21T05:08:00Z

← Older revision		Revision as of 00:08, 21 January 2010
Line 3:		Line 3:
	== Site Setup ==		== Site Setup ==

	Here's an example of what's needed to suexec isolate a specific site (this example is the setup for the [[Webmail\|webmail]].		Here's an example of what's needed to suexec isolate a specific site (this example is the setup for the [[Webmail\|webmail]]).

	'''dr-xr-xr-x 2 www-webmail www-webmail 4096 2010-01-20 21:57 /var/lib/roundcube/fcgi-wrapper'''		'''dr-xr-xr-x 2 www-webmail www-webmail 4096 2010-01-20 21:57 /var/lib/roundcube/fcgi-wrapper'''

Jbroman: created suexec entry

2010-01-21T04:28:57Z

created suexec entry

New page

[http://httpd.apache.org/docs/2.2/suexec.html suexec] is used allow [[Apache]] to isolate certain sites from the rest of the system by running them as users other than www-data (for example, webmail is run as www-webmail). The global suexec configuration is /etc/apache2/suexec/www-data, and suexec logs to /var/log/apache2/suexec.log.

== Site Setup ==

Here's an example of what's needed to suexec isolate a specific site (this example is the setup for the [[Webmail|webmail]].

'''dr-xr-xr-x 2 www-webmail www-webmail 4096 2010-01-20 21:57 /var/lib/roundcube/fcgi-wrapper'''

'''-r-xr-xr-x 1 www-webmail www-webmail 95 2010-01-20 21:57 php-cgi'''
#!/bin/sh
export PHP_FCGI_CHILDREN=3
export PHP_FCGI_MAX_REQUESTS=4000
exec /usr/bin/php5-cgi

'''-rwxr-xr-x 1 root root 71 2010-01-20 21:34 php-cgi-suexec'''
#!/bin/sh
exec /usr/lib/apache2/suexec www-webmail www-webmail php-cgi

And here is the relevant line in the vhost configuration:

FCGIWrapper "/var/lib/roundcube/fcgi-wrapper/php-cgi-suexec" .php