How to configure suEXEC Daemon? I can't get it to work...

M

Mikra

Active Member
#1
#1
I have an external php LSAPI app at the server level. It working perfectly for all websites.
But I want to enable suEXEC Daemon for more security in case one site gets hacked. I want every site to have it's own uid and the PHP processes to run on the same UID.

So at the server level, my external app has 'auto start' set to 'yes' and 'run on start up' set to 'suEXEC Daemon'.

At the virtual host level I have set 'ExtApp Set UID Mode' to 'DocRoot UID'.

I then restarted lsws and changed the document root uid (and all files/folder inside) to a new uid.

But it doesn't work. It's not forking new lsphp processes with the right uid. It still uses the "nobody" uid.

There's not much info about the suEXEC Daemon configuration so I hope someone here can help me out?

Thanks
 
N

NiteWave

Administrator
#2
#2
so you're using native vhost -- I've not tested with it.

it's mainly used in vhost from apache httpd.conf, the setting is simple - just
>'run on start up' set to 'suEXEC Daemon'
 
M

Mikra

Active Member
#4
#4
I just tried with a http config file. I removed the virtual host from lsws. Then I create a simple httpd.conf file like this:

<VirtualHost *:80>
ServerName www.test123.com
DocumentRoot /home/test123/www/public_html
</VirtualHost>

Still, it's not working. It is not using the uid of the folder /home/test123/www/public_html.
It still running as user nobody
 
M

Mikra

Active Member
#5
#5
Oh, I had to add 'SuexecUserGroup test123 test123' and it worked.

How do I make it work without an apache config file?
 
Last edited:
N

NiteWave

Administrator
#7
#7
Sorry I don't know the exact answer either for the question at the moment.
but likely the answer is No. i.e.:
while suExec Daemon works for native vhosts, but all lsphp process run as nobody

however for native vhosts, if you prefer each vhosts run lsphp as its own user, that's doable.
that need define a ext app "lsphp_vhost_xx" for this vhost.

this is similar to processGroup mode for shared host or apache's httpd.conf
( http://www.litespeedtech.com/products/litespeed-sapi/php/suexec-processgroup )
 
You must log in or register to reply here.
Top