suexec/fcgid problem - error 500

[GioMac]

Hi,

Don't know why, but on one of my environments faced with problem running php scripts with fcgid, tried to find differences between them - no luck... When i do some manipulations with suexec - it runs, but in case root, few times was able to get scripts running with virtual user, with insecure way, but it didn't show "Loaded Configuration File" path in phpinfo.

How it's possible to get full debug for both fcgid & suexec runtime?

[GioMac]

Code:

==> error_log <==
[Mon Mar 29 00:40:10 2010] [notice] mod_fcgid: call /var/www/virtual/test.ge/htdocs/some.php with wrapper /var/www/fcgi/test.ge/php5-fcgi-starter
[Mon Mar 29 00:40:10 2010] [info] mod_fcgid: server test.ge:/var/www/virtual/test.ge/htdocs/some.php(31752) started

==> test.ge-combined.log <==
77.92.229.53 - - [29/Mar/2010:00:40:10 +0400] "GET /errors/inc/errordocs.css HTTP/1.1" 304 - "http://test.ge/some.php" "ELinks/0.12pre5 (textmode; Linux; 191x48-2)"

==> users/test.ge-access.log <==
77.92.229.53 - - [29/Mar/2010:00:40:10 +0400] "GET /errors/inc/errordocs.css HTTP/1.1" 304 - "http://test.ge/some.php" "ELinks/0.12pre5 (textmode; Linux; 191x48-2)"

==> error_log <==
[Mon Mar 29 00:40:10 2010] [warn] [client 77.92.229.53] (104)Connection reset by peer: mod_fcgid: error reading data from FastCGI server
[Mon Mar 29 00:40:10 2010] [error] [client 77.92.229.53] Premature end of script headers: some.php

==> test.ge-combined.log <==
77.92.229.53 - - [29/Mar/2010:00:40:10 +0400] "GET /some.php HTTP/1.1" 500 780 "-" "ELinks/0.12pre5 (textmode; Linux; 191x48-2)"

==> users/test.ge-access.log <==
77.92.229.53 - - [29/Mar/2010:00:40:10 +0400] "GET /some.php HTTP/1.1" 500 780 "-" "ELinks/0.12pre5 (textmode; Linux; 191x48-2)"

==> test.ge-traf.log <==
780

==> error_log <==
[Mon Mar 29 00:40:13 2010] [notice] mod_fcgid: process /var/www/virtual/test.ge/htdocs/some.php(31752) exit(communication error), terminated by calling exit(), return code: 255

---

who can help with taking traces anyway?

one solution (thanks to malte):
change /bin/false to /bin/sh for user
cd to working dir
export variables specified in fcgid wrapper
strace -e open ./fcgid-wrapper

if ok - seems like problem is in running script as that user, in my case script was run by suexec, so, we've checked it and found that group doesn't match apache's one:

found it - was my fault:

Code:

# rpm -V httpd
S.5....T.  c /etc/httpd/conf.d/proxy_ajp.conf
S.5....T.  c /etc/httpd/conf/httpd.conf
S.5....T.  c /etc/sysconfig/httpd
.......T.    /usr/sbin/apachectl
......G..    /usr/sbin/suexec
......G..    /var/cache/mod_proxy
......G..    /var/lib/dav
......G..    /var/run/httpd

[kilburn]

Just for the record, suexec errors are logged to "/var/log/apache2/suexec.log" (and the group mismatch shows there).

[GioMac]

(03-29-2010 03:53 PM)kilburn Wrote:  Just for the record, suexec errors are logged to "/var/log/apache2/suexec.log" (and the group mismatch shows there).

Yes, but in my case suexec didn't run because apache had no rights to launch it, so, log file wasn't generated at all...