suPHP on plesk 7.5.3

Support/Development for PHP
JLChafardet
Forum User
Forum User
Posts: 46
Joined: Tue Dec 14, 2004 11:03 am

suPHP on plesk 7.5.3

Unread post by JLChafardet »

suPHP on plesk... well it seems that this is kind of a taboo, more a problem than a solution itself (because of things I have readed and experienced), This thread is basicly to request as much help as possible on the matter of knowing who executes what with php and also to allow your users to be able to modify/delete files uploaded via httpd with php forms.

On may 20, I managed to instal suPHP on my Plesk 7.5.3 box, but after an abnormal ammount of tryes to get horde working with it I decided to "DISABLE" it by commenting out the lines related to suphp_module on httpd.conf and the other config files.

On friday 12 of June, i received a couple of calls from some clients requesting me support as they dont know how to delete/modify some files on their site, what was my surprise when i checked the permission on the files that the files were owned by apache:apache.

I tryed to explain this to the clients and they told me something that is really true, if I am offering a service that will not let them upload files from http and later on modify/delete them, then I am not offering a good service, as email, AV, and the other sort of services that we webhost offer are not the main ones, usually clients come to us to HOST their SITES and also have emails and all other stuff.

Then I decided to retry "ENABLING" suPHP and see what the hell could be done with horde but to allow my clients to have the rights of their files.

A new surprice here... now it just dont work, no matter how do i configure it, no matter if i reinstall it or not, it just dont work.

There must be a way to have a way to have suPHP working with Plesk.... almost all other control panels have a phpsuexec option...

Now the fact of what i have been doing, so any of you can try it.

In the case that you dont have httpd-devel
[httpd-devel instalation]
up2date -i httpd-devel
or
yum install httpd-devel
(depending on your distro or way to install things)
[/httpd-devel instalation]

[suphp instalation procedure]

# cd /usr/local/src
# wget http://www.suphp.org/download/suphp-0.5.2.tar.gz
# tar -xvzf suphp-0.5.2.tar.gz
# cd suphp-*
# ./configure --prefix=/usr --with-apxs=/usr/sbin/apxs --with-apache-usr=apache --with-php=/usr/bin/php --with-setid-mode=owner --with-apache-user=apache
# make
# make install
[/suphp instalation procedure]
[suphp configuration]

# cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf-GOOD
# vi /etc/httpd/conf/httpd.conf

find the line

LoadModule mod_suphp /usr/lib/httpd/modules/mod_suphp.so

and delete it

add
## suPHP module ##
LoadModule suphp_module /usr/lib/httpd/modules/mod_suphp.so
suPHP_Engine On

Save and Exit on vi :x! [ENTER]

now, is where the problem comes, as if you have sitebuilder installed it will not work (if you get suphp working right ofcourse), so you will need to edit the /etc/httpd/conf.d/sitebuilder.conf

and add

suPHP_Engine Off

ServerAdmin sb_team@sw-soft.com
DocumentRoot /usr/local/sitebuilder
ServerName sitebuilder.*
ServerAlias sitebuilder.*
ErrorLog logs/sitebuilder-error_log
CustomLog logs/sitebuilder-access_log common
DirectoryIndex /wizard/index.php
AddDefaultCharset UTF-8
suPHP_Engine off

well now you will have sitebuilder working again, but still problems, as horde wont work (if you get suphp working right ofcourse)

then some of the last steep must be done, we have to add suPHP_Engine Off to an exclude file that we will create on /etc/httpd/conf.d called suphp_exclude.conf

just go to your /etc/httpd/conf/httpd.include and copy from it the lines related to horde and just right up the <directory line add it.

suPHP_Engine off
<Directory bla bla>


and restart apache
# service httpd restart


[/suphp configuration]


that "in theory" should allow horde to work.

well some of you will follow this and get it working some of you will not, and will ask/tell me, "hey but it/doesnt works".

the fact is that for me it doesnt. no matter how hard i try to configure/reconfigure/recompile it it will simply NOT work.

Please all i am asking is a bit of your time, effort to aid me (and a lot others to have a bit more secure box) to get this working.

Best regards,

JLChafardet
EvolutionCrazy
Forum User
Forum User
Posts: 67
Joined: Wed Jun 01, 2005 5:52 pm

Unread post by EvolutionCrazy »

hi JLChafardet

have you setted

php_admin_flag off

in the domains where you want to use suPHP instead of lib_php4?

in the procedure you have described you are using both lib_php4 and suPHP

however i've removed it... using it the load of my machine become a little bigger than normal....

completly disablig lib_php4 isn't possible becouse in that way we cannot use horde and we need to manually modify all the httpd.conf files becouse suPHP doen;t accepts commands like php_admin_flags and so on...

however from my testings:

you can use suPHP e lib_php4 without (php_admin_flag off) only with suPHP 0.5.2....
with suPHP 0.6.0 you absolutly need to disable lib_php4 inside the domains you want to use suPHP...

/me waiting for a native plesk support :)

in my case i'm planning to se a cron with
chown -R
every 12hours :D
JLChafardet
Forum User
Forum User
Posts: 46
Joined: Tue Dec 14, 2004 11:03 am

Unread post by JLChafardet »

/me waits the same.

I gave up.

will wait until the people of SW-Soft supports suphp natively.

regards,

JLChafardet
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Unread post by scott »

Im debating about doing an rpm for it, there are some pro's and con's to it. I have in my head how Id want to do it, which is to have separate users, one for uploading and one for the app running, then have the files/dirs created group writable. That way I could still enforce ASL policies like TPE (trusted path execution).
JLChafardet
Forum User
Forum User
Posts: 46
Joined: Tue Dec 14, 2004 11:03 am

Unread post by JLChafardet »

well cant deny that it would be nice if we can have a suphp or any phpsuexec that allowes to have the uploaded files under the ownership of the user.

just i wonder if it will work onmy box as suphp doesnt and i have checked and rechecked with no luck.

Best regards,

JLChafardet
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Unread post by scott »

Yeah, integration work is a lot of "fun" huh :P Imagine trying to do what youre doing right now, except its got to work on 6 different OS's, 3 major revs of PSA and be as easy as possible to install. Thats what I do all day long :P
JLChafardet
Forum User
Forum User
Posts: 46
Joined: Tue Dec 14, 2004 11:03 am

Unread post by JLChafardet »

i certainly DONT envy you LOL

but i wish i can learn that much you know!

soon :) and i'll be packaging rpms myself ;)

hehe, you rocks.

Regards,

JLChafardet
kilgore
Forum User
Forum User
Posts: 53
Joined: Sat Dec 04, 2004 4:37 am

Unread post by kilgore »

Hi all,

I was trying to run mod_suphp 6.1 since 3 days when I read this thread. Installing mod_suphp 5.2 runs like a charm !

I've added the suPHP_engine off for webmail and default vhost and everything run fine !

Also, don't forget to change session.save_path = /var/lib/php/session to session.save_path = /tmp in your php.ini.

For the moment load hasn't increase !

See you !

Kilgore
strolfey
Forum User
Forum User
Posts: 5
Joined: Sun Feb 12, 2006 8:27 pm

Unread post by strolfey »

Kilgore, did you follow the steps above, or did you do something else? I tried installing suphp 5.2, and I got an Internal Server Error.
Plesk 7.5.4
Fedora Core 3
strolfey
Forum User
Forum User
Posts: 5
Joined: Sun Feb 12, 2006 8:27 pm

Unread post by strolfey »

I get Internal Server Error when mod_suphp is placed directly below the list of other loadmodules, and suPHP_engine on right after that. I also get session write errors, in both /var/liib/php/session and /tmp.

The error log says:
Error in suphp.c on line 256: Inappropriate permissions set on script, ...

When I leave it where the installer puts it (near the end of the conf file), and put suPHP_engine on after that, it seems to get ignored; new files are still created as apache/apache.

Does anyone know what's going on there?

Also, I'm not familiar with where I would put suPHP_engine Off for webmail (horde). Although the site currently doesn't use webmail, I'd like to have that capability.
Plesk 7.5.4
Fedora Core 3
kilgore
Forum User
Forum User
Posts: 53
Joined: Sat Dec 04, 2004 4:37 am

Unread post by kilgore »

strolfey wrote:Kilgore, did you follow the steps above, or did you do something else? I tried installing suphp 5.2, and I got an Internal Server Error.
I've done exactly what is written and there's still no problem...
BDMM
Forum User
Forum User
Posts: 9
Joined: Fri Feb 17, 2006 3:00 am

Unread post by BDMM »

Hi,

I got it all to work quite well.

Check out http://forums.swsoft.com/showthread.php ... tid=135064

Personally I can see no real reason why this cant be implemented in the plesk control panel on a per site/directory basis.

BD
BDMM
Forum User
Forum User
Posts: 9
Joined: Fri Feb 17, 2006 3:00 am

Unread post by BDMM »

I set my session path in my new php.ini to /home/httpd/vhosts/<domain>/tmp

Can anyone see this as a security issue or should I set it to /tmp

Thanks
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Unread post by scott »

It doesnt really matter, basically youre saying what directory PHP can write to outside of the users world writable directories. It would'nt have any effect on stopping exploit code from running.
JLChafardet
Forum User
Forum User
Posts: 46
Joined: Tue Dec 14, 2004 11:03 am

any news on this subject?

Unread post by JLChafardet »

any news on this subject about suphp on psa?
Post Reply