Will PHP-CGI run anything as apache user?

[wtfbrb]

I have php-cgi configured and I sometimes see processes by users (as I believe they should be), but I also have had some security issues and I see 11-20 apache owned processes going...is that normal?

 

[nobaloney]

It doesn't sound right to me; hopefully someone else will post.

Jeff

 

[BestBoard]

Apache processes?

like this?

apache 18700 0.0 0.1 14052 5820 ? S 00:13 0:00 /usr/sbin/httpd -k start -DSSL
apache 28962 0.6 0.2 556288 10792 ? Sl 02:33 0:00 /usr/sbin/httpd -k start -DSSL

but they owned by your users?

 

[wtfbrb]

Kind of

Here is the output that I am talking about...
# pstree -u | grep apache
|-httpd---11*[httpd(apache)]

 

[eagle]

Don't httpd processes still continue to run as apache/nobody and don't only run php processes as a separate user?

 

[wtfbrb]

Good question

So what you are saying is that static html pages (including the pages joomla caches) still always run as apache? And only the php pages are run as user?

 

[localhost]

Here is the output that I am talking about...
# pstree -u | grep apache
|-httpd---11*[httpd(apache)]

You should post a

ps faux | grep httpd

rather than a pstree. And YES, if you are not using PHP SUEXEC but you have PHP running as a CGI then all the scripts will run under apache:apache or the user and group that is set in your httpd.conf

 

[nobaloney]

@localhost:

Perhaps I'm just confused.

I use the standard custombuild solution for running php as cgi:

default_php=5
php5_cli=no
php5_cgi=yes
php4_cli=no
php4_cgi=no
php_ini=yes

and I do nothing special to implement suPHP (that I can think of now, or that I can find).

And it appears from my configuration files that suPHP is installed by default.

And php is run as cgi, by USERNAME, not by apache user.

Where am I going wrong?

Jeff

 

[localhost]

Well, you just skiped this:
if you are not using PHP SUEXEC

I had servers running PHP as CGI without SUEXEC and everything was runned under apache user.

 

[nobaloney]

I'm sorry; I obviously didn't make my point clear. My point was that custombuild seems to set it up automatically without specifically mentioning it. At least I think it does.

Does it?

Jeff

 

[localhost]

Now it does, but back in '90 ... well that's a different story.

 

[MtK]

any conclusion on this matter?

 

[nobaloney]

any conclusion on this matter?

What matter? What is your specific question?

Jeff