Migrating to suPHP

[elbarto]

Hi guys,

I have a couple of production servers with Apache 2.2 and PHP running through mod_php. I've been reading that it's much more secure to use suPHP and that it would prevent my users to have troubles with the owner and permissions of dynamically generated files.

I'm thinking of migrating to suPHP then, and wanted to know what kind of things I should have in mind for the change. Since the servers are in production I would need to make this migration taking all the necessary precautions so that users don't even notice the change.

Here's what I think I should do. Please correct me if I'm wrong and let me know if you have further suggestions/comments/experiences to share.

- Install suPHP using Custombuild

cd /usr/local/directadmin/custombuild
./build suphp

- Change permissions and owners of folders and files (seen here):

cd /usr/local/directadmin/scripts && ./set_permissions.sh user_homes
find /home/*/domains/*/public_html -type d -print0 | xargs -0 chmod 711
find /home/*/domains/*/public_html -type f -print0 | xargs -0 chmod 644
cd /usr/local/directadmin/data/users && for i in `ls`; do { chown -R $i:$i /home/$i/domains/*/public_html;}; done;

Thanks!

 

[scsi]

Ok thanks.

 

[elbarto]

Ok thanks.

Is there anything else I'm missing? Do you have any experience with such migration that you could share?

 

[smtalk]

- Install suPHP using Custombuild

cd /usr/local/directadmin/custombuild
./build suphp

Use the following instead:
Set phpX_cgi=yes and phpX_cli=no (X is your PHP version (4, 5 or 6) in the options.conf file, if you want to run PHP as CGI (suPHP) only and execute:

cd /usr/local/directadmin/custombuild
./build php n

Good luck!

 

[zEitEr]

Is there anything else I'm missing? Do you have any experience with such migration that you could share?

Take care of .htaccess.
Directives php_flag and php_value will cause a 500 error to occur.

 

[elbarto]

Thanks for the heads up, zEitEr.

smtalk, I want to run PHP as CGI and also via CLI, but stop using mod_php... is this possible?

 

[tomtom901]

I don't think that is possible..

 

[elbarto]

I don't think that is possible..

Hmm... I should be possible at least to re-build php setting php5_cgi and php5_cli and then comment out the line which loads mod_php on the httpd.conf, right?

 

[zEitEr]

If you install PHP-CGI, there still will be installed PHP-CLI. Directadmin needs a PHP-CLI installed on your server. But you won't be able by default use both PHP5-CGI and PHP5-CLI (via mod_php) for your virtual hosts.