suexec apparently not working

[bpratt]

Had a user who has installed joomla under his domain, and when he adds components to it, the file ownership becomes the same as the apache2 user, rather than the vu0000 user, which is creating a problem for them.

I'm pretty sure suexec is working, as I'm getting items in the suexec log, but only for the original domain that was setup on this server.


This is ispcp R2c running under Debian Etch.

All help welcomed.

[pgentoo]

bpratt Wrote:Had a user who has installed joomla under his domain, and when he adds components to it, the file ownership becomes the same as the apache2 user, rather than the vu0000 user, which is creating a problem for them.

I'm pretty sure suexec is working, as I'm getting items in the suexec log, but only for the original domain that was setup on this server.


This is ispcp R2c running under Debian Etch.

All help welcomed.

Just because suexec is working for the main domain (ispcp) it doens't mean it is working for the client domains, as these are generated using different template files. I'm assuming the .tpl files for user domains are not setup correctly for working fastcgi/suexec...

You might want to look at upgrading to a recent nightly build, as the current trunk has a ton of bugs resolved as compared to RC2c. If this isn't an option, attach the domain's section from your ispcp.conf file (from apache conf directory), and obscure the ip/domain. Myself or someone else can point you in the right direction for getting up and running with suexec for user domains.

-
Jesse

[bpratt]

pasichnyk Wrote:You might want to look at upgrading to a recent nightly build, as the current trunk has a ton of bugs resolved as compared to RC2c. If this isn't an option, attach the domain's section from your ispcp.conf file (from apache conf directory), and obscure the ip/domain. Myself or someone else can point you in the right direction for getting up and running with suexec for user domains.

I'm a little bit unsure about upgrading to a nightly build at the moment, and was hoping to have seen a RC3 come out by now with a upgrade script.

Okay, here's the specific section of my ispcp.conf :-

Code:

# httpd [lovetheloganvalley.org.au] dmn entry BEGIN.
<VirtualHost 203.55.xxx.yy:80>

    <IfModule mod_fastcgi.c>
        SuexecUserGroup vu2045 vu2045
    </IfModule>

    ServerAdmin     root@lovetheloganvalley.org.au
    DocumentRoot    /var/www/virtual/lovetheloganvalley.org.au/htdocs

    ServerName      lovetheloganvalley.org.au
    ServerAlias     www.lovetheloganvalley.org.au lovetheloganvalley.org.au *.lovetheloganvalley.org.au

    ErrorLog        /var/log/apache2/users/lovetheloganvalley.org.au-error.log
    TransferLog     /var/log/apache2/users/lovetheloganvalley.org.au-access.log

    CustomLog       /var/log/apache2/lovetheloganvalley.org.au-traf.log traff
    CustomLog       /var/log/apache2/lovetheloganvalley.org.au-combined.log combined

    Alias /errors   /var/www/virtual/lovetheloganvalley.org.au/errors/

    ErrorDocument 401 /errors/401/index.php
    ErrorDocument 403 /errors/403/index.php
    ErrorDocument 404 /errors/404/index.php
    ErrorDocument 500 /errors/500/index.php

    Redirect /stats http://lovetheloganvalley.org.au/awstats/awstats.pl
    Redirect /ispcp http://virtual.overflow.net.au

    # httpd dmn entry cgi support BEGIN.
    ScriptAlias /cgi-bin/ /var/www/virtual/lovetheloganvalley.org.au/cgi-bin/
    <Directory /var/www/virtual/lovetheloganvalley.org.au/cgi-bin>
        AllowOverride None
        #Options ExecCGI
        Order allow,deny
        Allow from all
    </Directory>
    # httpd dmn entry cgi support END.

    <IfModule mod_fastcgi.c>
        ScriptAlias /php4/ /var/www/fcgi/lovetheloganvalley.org.au/
        <Directory "/var/www/fcgi/lovetheloganvalley.org.au">
            AllowOverride None
            Options +ExecCGI -MultiViews -Indexes
            Order allow,deny
            Allow from all
        </Directory>
    </IfModule>

    <IfModule mod_php4.c>
        <Directory /var/www/ispcp/gui>
            php_admin_value open_basedir "/var/www/ispcp/gui/:/etc/ispcp/:/proc/:/var/www/virtual/:/bin:/sbin:/usr/bin:/usr/
            php_admin_value session.save_path "/var/www/ispcp/gui/phptmp/"
        </Directory>
    </IfModule>

    # httpd dmn entry PHP2 support BEGIN.
    <IfModule mod_php4.c>
        php_admin_value open_basedir "/var/www/virtual/lovetheloganvalley.org.au:/var/www/virtual/lovetheloganvalley.org.au/
        php_admin_value upload_tmp_dir "/var/www/virtual/lovetheloganvalley.org.au/phptmp"
        php_admin_value session.save_path "/var/www/virtual/lovetheloganvalley.org.au/phptmp"
        php_admin_value sendmail_path '/usr/sbin/sendmail -f vu2045 -t -i'
    </IfModule>
    # httpd dmn entry PHP2 support END.

    <Directory /var/www/virtual/lovetheloganvalley.org.au/htdocs>
        # httpd dmn entry PHP support BEGIN.
        # httpd dmn entry PHP support END.
        Options -Indexes Includes FollowSymLinks MultiViews
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>

</VirtualHost>
# httpd [lovetheloganvalley.org.au] dmn entry END.

Thanks for your help.

[pgentoo]

bpratt Wrote:

pasichnyk Wrote:You might want to look at upgrading to a recent nightly build, as the current trunk has a ton of bugs resolved as compared to RC2c. If this isn't an option, attach the domain's section from your ispcp.conf file (from apache conf directory), and obscure the ip/domain. Myself or someone else can point you in the right direction for getting up and running with suexec for user domains.

I'm a little bit unsure about upgrading to a nightly build at the moment, and was hoping to have seen a RC3 come out by now with a upgrade script.

Okay, here's the specific section of my ispcp.conf :-

Code:

...
    <IfModule mod_fastcgi.c>
        SuexecUserGroup vu2045 vu2045
    </IfModule>
...

Do you actually have mod_fastcgi running? You may have to make a conf change to your httpd.conf or /etc/conf.d/apache2 in order to turn it on... I am really not familiar with how debian works, so hopefully someone else can provide better guideance...


Also, if you want to run this without fastcgi, and just suexec, you could change the <IfModule line to require suexec instead of fastcgi...


EDIT: the trunk now for debian uses the following instead of what you have...

Code:

<IfModule suexec_module>
     SuexecUserGroup {SUEXEC_USER} {SUEXEC_GROUP}
</IfModule>

This way even if you don't have fastcgi setup, your cgi's will still run as the user's account. But it really looks like you don't even have fastcgi running currently...

[bpratt]

pasichnyk Wrote:

bpratt Wrote:

Code:

...
    <IfModule mod_fastcgi.c>
        SuexecUserGroup vu2045 vu2045
    </IfModule>
...

Do you actually have mod_fastcgi running? You may have to make a conf change to your httpd.conf or /etc/conf.d/apache2 in order to turn it on... I am really not familiar with how debian works, so hopefully someone else can provide better guideance...


Also, if you want to run this without fastcgi, and just suexec, you could change the <IfModule line to require suexec instead of fastcgi...


EDIT: the trunk now for debian uses the following instead of what you have...

Code:

<IfModule suexec_module>
     SuexecUserGroup {SUEXEC_USER} {SUEXEC_GROUP}
</IfModule>

This way even if you don't have fastcgi setup, your cgi's will still run as the user's account. But it really looks like you don't even have fastcgi running currently...

Yes, it appears I haven't got fastcgi setup, which I thought was done with the install of ispcp, and that I didn't have to do anything more.

I hope that someone can post a link to a quick install of fastcgi, but I might just try to see if the new suexec module will fix it for me.

Thanks for your help.

[pgentoo]

bpratt Wrote:

pasichnyk Wrote:

bpratt Wrote:

Code:

...
    <IfModule mod_fastcgi.c>
        SuexecUserGroup vu2045 vu2045
    </IfModule>
...

Do you actually have mod_fastcgi running? You may have to make a conf change to your httpd.conf or /etc/conf.d/apache2 in order to turn it on... I am really not familiar with how debian works, so hopefully someone else can provide better guideance...


Also, if you want to run this without fastcgi, and just suexec, you could change the <IfModule line to require suexec instead of fastcgi...


EDIT: the trunk now for debian uses the following instead of what you have...

Code:

<IfModule suexec_module>
     SuexecUserGroup {SUEXEC_USER} {SUEXEC_GROUP}
</IfModule>

This way even if you don't have fastcgi setup, your cgi's will still run as the user's account. But it really looks like you don't even have fastcgi running currently...

Yes, it appears I haven't got fastcgi setup, which I thought was done with the install of ispcp, and that I didn't have to do anything more.

I hope that someone can post a link to a quick install of fastcgi, but I might just try to see if the new suexec module will fix it for me.

Thanks for your help.

The default .tpl files which are used to setup the users sites, are only configured to use mod_php or mod_fastcgi, depending on how you have apache configured. So if you are not setup for mod_fastcgi currently, you are likely using mod_php. Take a look at your apache conf files and /etc/conf.d/apache2 file to see what you are currently running.

If you are currently running mod_php, it might be best to just wait a little bit until RC3 is released, then upgrade and get mod_fastcgi working at that point. There have been a ton of changes between RC2c and RC3, so fastcgi will likely work out of the box (if you switch your apache from mod_php to fastcgi), especially since you are running on debian. I'm not sure the state of fastcgi support on debian as of RC2c, it may require some manual tweaks to get working, but also may work fine... I'm just not sure.

Hopefully I've helped shed some light on your situation.

I'm off to bed now... Have a good night,
Jesse