suexec configured to run under /var/www ...

Hallo,

I am trying to run Virtualmin on a Debian 4.0 Etch server, but am getting this error:

The Suexec command on your system is configured to only run scripts under /var/www, but the Virtualmin base directory is /home. CGI and PHP scripts run as domain owners will not be executed.

How do I configure Suexec, so that scripts can be run under /home ?

Thank you !

Kind regards from Germany

Mebus<br><br>Post edited by: Mebus, at: 2008/09/29 04:45

Well, that might happen if your system has the Debian Apache packages rather than the Virtualmin packages.

The Virtualmin version of suexec is compiled with support to run those in /home.

How did you install Virtualmin, out of curiosity?

In /etc/apt/sources.list, do you see an entry for the Virtualmin repositories, at software.virtualmin.com?
-Eric

I downloaded the Webmin and Virtualmin deb packages from webmin.com and installed them via dpkg -i.

Anyway I have found a solution to my problem by recompiling the module:

http://planetozh.com/blog/2007/10/rebuilding-suexec-with-different-options-on-ubuntu/

http://swelltech.com/support/virtual-servers/index.html#apache

Thanks anyway or is there a better solution ?

Mebus

Ahh, there’s actually an install.sh script for installations that actually pulls in all the dependencies and such:

http://webmin.com/vinstall.html

Don’t run that on a working system, that’s just for future reference :wink:

In the meantime – yes, you could recompile suexec, though if you just installed the Apache packages from the Virtualmin repository, that’d handle your issue too.

It sounds like you may be using the GPL version, so the packages for that can be found at:

http://software.virtualmin.com/gpl/

For the Pro version, just drop the "gpl" from the URL above, and enter your serial and license key numbers when prompted.
-Eric

Okay, but what’s this:

server:~# /etc/init.d/apache2 restart Forcing reload of web server (apache2)...Warning: SuexecUserGroup directive requires SUEXEC wrapper. Warning: SuexecUserGroup directive requires SUEXEC wrapper. Warning: SuexecUserGroup directive requires SUEXEC wrapper. Warning: SuexecUserGroup directive requires SUEXEC wrapper. Warning: SuexecUserGroup directive requires SUEXEC wrapper. Warning: SuexecUserGroup directive requires SUEXEC wrapper. Warning: SuexecUserGroup directive requires SUEXEC wrapper. Warning: SuexecUserGroup directive requires SUEXEC wrapper. waiting Warning: SuexecUserGroup directive requires SUEXEC wrapper. Warning: SuexecUserGroup directive requires SUEXEC wrapper. Warning: SuexecUserGroup directive requires SUEXEC wrapper. Warning: SuexecUserGroup directive requires SUEXEC wrapper. Warning: SuexecUserGroup directive requires SUEXEC wrapper. Warning: SuexecUserGroup directive requires SUEXEC wrapper. Warning: SuexecUserGroup directive requires SUEXEC wrapper. Warning: SuexecUserGroup directive requires SUEXEC wrapper. . server:~#

Mebus

Howdy,

Sounds like Virtualmin has been configured to add in the SuexecUserGroup directives, but Apache may be missing the suexec module.

You can enable suexec support in Apache with:

a2enmod suexec

And then restart Apache.

That will only work if you’re using an Suexec compiled with /home of course.
-Eric

This module is already enabled!

Mebus

Hi,

I am having the same issue but on CentOS 5.2. What packages do i need from http://software.virtualmin.com/gpl/centos/5.2/i386/?

Best regards
nic

Well, the suexec binary comes with the httpd package, so you’ll at the very least need that. It changes very little, so there shouldn’t be a problem in installing that in place of your current httpd package.

The catch in just downloading those is that when updates come out, you won’t get them… ideally, you’d want to setup the VM repository by setting it up in /etc/yum.repos.d.

It strikes me that perhaps we need a document containing steps for fixing this particular predicament :slight_smile:
-Eric

Hey Mebus – when you get "Warning: SuexecUserGroup directive requires SUEXEC wrapper.", are you seeing any errors in the Apache error_log?

The suexec module may be failing to load, in which case it may send it’s error into the logs.
-Eric

Hi Mebus, hi all,

after running into the same problem, I crawled the net for solutions. This did the trick: (Found on http://bliki.rimuhosting.com/space/virtualmin+notes)

On Debian disable suexec in Apache. From the main virtualmin configuration page, click on the "Edit Server Template" button. Click on the "Default Settings" template link in the table on the next page. In the "edit template section" at the top of that page, choose "Apache website". Click the radio button to no, where it says "Automatically add appropriate SuExec directive?".
BTW, I'm using Virtualmin Pro.

This issue appeared just after upgrading to Virtualmin 3.62 and I’m somewhat dissappointed that there is no support from the Virtualmin-Team on this topic! Re-Compiling apache is not acceptable!

Have fun,
Michael

Howdy,

There’s no need to recompile Apache.

The problem is that the Virtualmin Apache packages aren’t installed – that’s something that the install.sh script handles during installation.

Since you aren’t using suexec, disabling that feature will work fine as Joe mentioned in another thread.

If you’d like to use suexec, no problem, you’ll just need to install the Virtualmin Apache from sofware.virtualmin.com.
-Eric

I'm somewhat dissappointed that there is no support from the Virtualmin-Team on this topic!

I’m sorry you feel like there hasn’t been support on this topic. But, for what it’s worth, Eric and I have both answered this same question in a half dozen threads–in all cases in the best way we could, based on the knowledge we were given. The possible solutions are:

Disable suexec usage in Virtualmin

Use a suexec binary that will work with your configuration in Virtualmin

That’s what we’ve said every time we’ve been asked this question (or its minor variants). This new check and its result is legitimate–you really can’t use suexec, if it isn’t built appropriately for where your home directories are. It’s just that we were never testing for it before now…but we found that it was a very common source of questions and support issues. It’s not a false positive, and we thought you’d want to know about the problem. Perhaps the error message is not clear enough?

What could we be doing differently here that would give you a feeling of getting support from us?

I ran into a similiar problem just by updating virtualmin from 3.60 to 3.62. Actually I’m always in fear, that the upgrade breaks something.
Now rechecking the configuration ends with a complaint that suexec is not available on my system…

I didn’t change anything in between. What happened?

So I seem not to run Virtualmin Apache (I have no clue what else)? How can I replace the existing with it?

Well, as Joe’s post mentions above, nothing “changed” – except that Virtualmin tests the configuration of your system better now :slight_smile:

Somehow or another, you don’t have Virtualmin’s Apache packages, so the suexec binary on your system isn’t pointing to the right place.

You can solve that by:

  1. Disabling suexec in Virtualmin

  2. Use an suexec binary that points to /home rather than /var/www – an easy way to do that is to use the Virtualmin Apache packages from software.virtualmin.com

Seeing as your system is otherwise working, that implies you aren’t using suexec, so the quickest solution might just be to disable that. You can do so in System Settings -> Server Templates -> Default -> Apache Website, then make sure “Automatically add appropriate SuExec directive” is set to “No”.
-Eric

My system say that I have webmins version of apache installed. I was in stalled by webmin. Is there a diffrence between webins version and virtualmins?

Do I have to Uninstall Apache and reinstall?

Shanta

Hey Shanta,

I don’t recall if you’re using CentOS/RHEL or Ubuntu/Debian, but I’m curious of the package names you have installed.

So if it’s CentOS/RHEL that you have, what’s the output of this:

rpm -qa | grep httpd

And if it’s Ubuntu/Debian, what does this show:

dpkg -l ‘apache*’

Thanks,
-Eric

I ran into a similiar problem just by updating virtualmin from 3.60 to 3.62. Actually I'm always in fear, that the upgrade breaks something. Now rechecking the configuration ends with a complaint that suexec is not available on my system...

Nothing (new) is broken! The system is still working just as it always has!

These are configuration checks…please don’t let these warnings stop you from upgrading. You should always run the latest version of the software. The configuration checks are getting better at telling you things that might be wrong with your configuration…they are not changing your system or breaking it in any way.

How can we make that more clear? (I’m approaching a panicked state now that I’m realizing that people might not upgrade for fear of seeing these kinds of messages in the configuration check. Do not fear greater knowledge about your system. Please!)

My system say that I have webmins version of apache installed. I was in stalled by webmin. Is there a diffrence between webins version and virtualmins?

There is no “Webmin version” of Apache. Webmin.com has no software repositories for any non-Webmin software. When you install software using Webmin’s Software Packages module, it uses whatever the native package manager for your operating system is, like yum or apt-get. It has no way of knowing what version is being installed–whatever software repositories your system is configured to use is where the packages will come from.

If you installed Virtualmin using the automated install script found here at Virtualmin.com (install.sh, found on the download page or the serial numbers page, if you have Professional), it will have setup the package manager to use our software repositories, and will (usually, unless there are errors) install our Apache version. If you did not use the install script, you almost certainly do not have our Apache version (and this warning during configuration check indicates you don’t).

Do I have to Uninstall Apache and reinstall?

No. Just upgrade to our Apache package. That is, assuming you want to use suexec. If you don’t care, just leave it the way it is and turn off suexec in Virtualmin.

I am running a fresh install of Debian. I set the sources list to include the virturalmin repository and installed each module as it tested the install using webmin.

When I went to the Virtualdmin update link off the status page and it showed that apache came from webmin. I even copied the lines to a message I sent to another thread on this topic. I don’t see it now after searching.

On checking the updates page it now shows the Debian version installed.

This whole install have been nothing but problematic I was hoping that it was a faulty install that was causing my previous mail, and cgi problems. I even used webmin to install all modules during the testing process.

It is the public version so I guess that is a possible reason why.

On ward. I just did an apt-get update and it says that all my programs are up to date. Should I remove apache and try installing again?