Convert PHP sites to use mod_fcgid with suEXEC

Virtualmin
41

Ok, so this is all a puddle of mud at this point. I have an existing installation of Virtualmin running on Debian and I can’t afford the downtime to go through from scratch. I see that apache already has a module for fcgid in the configuration files, and that it is active. So, I’m guessing I just need to, as the first post stated, “recompiled suEXEC with docroot /home.” ?
/etc/apache2/httpd.conf is completely empty for me, so I have been editing the /etc/apache2/sites-available/<DOMAINNAME>.conf files. Incorrect?

What I have done:

  1. Made a directory and file "/home/DOMAIN-USER/fcgi-bin/php5.fcgi that literally has:

[code:1]#!/bin/bash
PHPRC=$PWD/…/etc/php5
export PHPRC
umask 022
SCRIPT_FILENAME=$PATH_TRANSLATED
export SCRIPT_FILENAME
exec /usr/bin/php-cgi[/code:1]

  1. Copied the file "/etc/php5/php.ini" to "/home/DOMAIN-USER/etc/php5/php.ini"

  2. In the web access portal for my server (which is not in physical proximity), I went to Webmin > Servers > Apache Webserver, clicked on "Global Configuration", clicked on the "Edit Config Files" icon, selected "etc/apache2/sites-available/<DOMAINNAME>.conf" and pressed the Edit Directives in File button. That file looks like this after I added the two lines:

[code:1]…
<Directory /home/DOMAIN-USER/public_html>
Options -Indexes IncludesNOEXEC FollowSymLinks
allow from all
AllowOverride All
AddHandler fcgid-script .php
FCGIWrapper /home/DOMAIN-USER/fcgi-bin/php5.fcgi .php
</Directory>
…[/code:1]

I have this PHP script to test it out, and so far here is the only results I get:
PHP Script "test.php"

[code:1]<?php
echo posix_getuid();
print("<br/>\n<br/>\n"«»);
echo getmyuid();
?>[/code:1]

33

1004

So, I will keep at it, but I am getting more confused the more I read and would love for someone to shed some light on what I have left to do. Also, I wonder if I should do these steps with each and every virtual server account so that the PHP scripts won’t be broken? Anyway, thanks all.

42

Ok, so this is all a puddle of mud at this point. I have an existing installation of Virtualmin running on Debian and I can’t afford the downtime to go through from scratch. I see that apache already has a module for fcgid in the configuration files, and that it is active. So, I’m guessing I just need to, as the first post stated, “recompiled suEXEC with docroot /home.” ?
/etc/apache2/httpd.conf is completely empty for me, so I have been editing the /etc/apache2/sites-available/<DOMAINNAME>.conf files. Incorrect?

What I have done:

  1. Made a directory and file "/home/DOMAIN-USER/fcgi-bin/php5.fcgi that literally has:

[code:1]#!/bin/bash
PHPRC=$PWD/…/etc/php5
export PHPRC
umask 022
SCRIPT_FILENAME=$PATH_TRANSLATED
export SCRIPT_FILENAME
exec /usr/bin/php-cgi[/code:1]

  1. Copied the file "/etc/php5/php.ini" to "/home/DOMAIN-USER/etc/php5/php.ini"

  2. In the web access portal for my server (which is not in physical proximity), I went to Webmin > Servers > Apache Webserver, clicked on "Global Configuration", clicked on the "Edit Config Files" icon, selected "etc/apache2/sites-available/<DOMAINNAME>.conf" and pressed the Edit Directives in File button. That file looks like this after I added the two lines:

[code:1]…
<Directory /home/DOMAIN-USER/public_html>
Options -Indexes IncludesNOEXEC FollowSymLinks
allow from all
AllowOverride All
AddHandler fcgid-script .php
FCGIWrapper /home/DOMAIN-USER/fcgi-bin/php5.fcgi .php
</Directory>
…[/code:1]

I have this PHP script to test it out, and so far here is the only results I get:
PHP Script "test.php"

[code:1]<?php
echo posix_getuid();
print("<br/>\n<br/>\n"«»);
echo getmyuid();
?>[/code:1]

33

1004

So, I will keep at it, but I am getting more confused the more I read and would love for someone to shed some light on what I have left to do. Also, I wonder if I should do these steps with each and every virtual server account so that the PHP scripts won’t be broken? Anyway, thanks all.

43

Hi interknighterrant,

Did you managed to start and run your php as FastCGI with suexec?
I am a noob and have tried to follow this post to configure but getting no where :frowning:

44

This thread is way too big follow. Anyone want to make this into one script and provide it to us? Please. hah

45

Here is the script i came up with, works fine in debian 5 and ubuntu 8.04.

Setup LAMP Server Using Virtualmin

46

I tried to install following the steps in turn in this thread. Unfortunately, I have some problems. Why I do not have the directory / var / log / httpd /? Should I install some packages in addition to the installation of Virtualmin?

47

The directory /var/log/httpd would exist on CentOS / RHEL based distros.

If you’re using Ubuntu or Debian, you’d want to look for /var/log/apache2.

-Eric

48

I’m using mod_fcgid now, because a bug (i think). Is anyone knows how to make apache work again ? My problem is that when a client tries to upload file via http the file is created with apache:apache privs. With mod_fcgid there is no problem, but i want to use apache.

49

Yeah, you’d have to use either fcgid or cgi together with suexec in order to have the files created as the Virtual Server owner.

If you use mod_php, it’ll create the files as apache:apache.

I’m not aware of a way to get the user permissions you want, along with mod_php.

Is there a reason mod_fcgid won’t work for you?

-Eric

50

I have some sites with free cms silverstripe, and they dont work with mod_fcgid… :confused: Do you know how to get mod_cgi to work again ?

51

When you setup fcgid, you added these lines into your Apache config:

AddHandler fcgid-script .php FCGIWrapper /home/example/fcgi-bin/php5.fcgi .php

To use CGI, you’d use something like this instead:

AddType application/x-httpd-php5 .php Action application/x-httpd-php5 /cgi-bin/php5.cgi
52

I’m sure i’m wrong somewhere, but… i donno where :confused: I have installed a virtualmin on a testmachine and there the

AddType application/x-httpd-php5 .php
Action application/x-httpd-php5 /cgi-bin/php5.cgi

was commented. I have run out of ideas. Any help is welcomed.

53

i am a newbie and want to convert my existing site ( running as virtual host in Virtuamin GPL) to fcgid and suexec due to difference in FTP uplaod permissions issue.

In My existing site setup Cgi-bin is running under webroot ( cg-bin is part of application) and for that i have set the virtual host directive accordingly. i.e.

/home/domain/public_html/ ----> ( php scripts placed here)
/home/domain/public_html/cgi-bin —> ( other scripts placed here like perl etc)

MY quesiton is if i convert my existing site as per the instructions by Joe (https://www.virtualmin.com/node/8462#comment-35141) and create the directory /fcgi-bin , would my existing cgi-bin still work or do i need to copy my scripts from cgi-bin to fcgi-bin.?

woul appreciate any help on this…

54

Whether you use the name “cgi-bin”, “fcgi-bin”, or “boing-boing-yoink-foo” doesn’t really matter – it’s largely just a convention.

If you already have directories named “cgi-bin”, that’s fine, just replace the name fcgi-bin anywhere Joe wrote that, with the “cgi-bin” name that you’re already using.

-Eric

55

Hey folks,

Just thought I’d drop a line in on this thread.

For my setup, since I’m using Virtualmin GPL, I did the following given the instructions that were provided in this thread already, which has worked miracles with my setup.

I added the following to “/etc/skel” directory:

/etc


   /php.ini

/fcgi-bin


   /php.fcgi

Then I added the following to the “Apache Website” section of each template (between the <Directory> tags:

In the “Options” line I added:

ExecCGI

Just before the </Directory> tag I added:

AddHandler fcgid-script .php


FCGIWrapper /home/domain_dir/fcgi-bin/php.fcgi .php

In addition to this, due to the way I treat “Sub-Servers” on my system, I also created a second “skel” directory for example purposes we’ll call it “/etc/skel2” and added the directory/file setup as above, and simply modified the FCGIWrapper line to reflect the correct location to the “fcgi-bin” directory.

What this effectively does is, creates all the Apache directives, and places the corresponding files into the correct place under the domain’s directory so they can be used.

Anyways, That’s my setup!

56

In my gpl i don’t see “Default PHP execution mode” just an add suexec option. If i used virt to nuke alll of the sites and then recreated them would they then have the correct settings for user-level running of scripts tow ork then?

57

Virtualmin GPL doesn’t provide a GUI for managing the PHP execution mode. By default, it typically uses mod_php (which doesn’t utilize suexec).

This thread here describes how you can setup suexec along with PHP using Virtualmin GPL:

http://www.virtualmin.com/node/8462

58

so if i tell it add suexec in gpl and then save that template that does NOT get applied to subsequent servers?

If that’s the case what if i simply erased everything and configured that by default would it work then? I jsut need a way to run things 755 instead of 777.

59

It does get applied to subsequent servers… it doesn’t automatically get applied to existing servers.

For existing servers, you could either enable it manually, or even use the command line tools to enable it. Run the command “virtualmin modify-web” to see some options – you can use the “–suexec” param in order to modify that setting for existing domains.

-Eric

60

found another way. I just set the user and group permissions to apache.