Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Last revision Both sides next revision | ||
|
litespeed_wiki:php:which_php_setup_am_i_using [2018/08/06 21:33] Lisa Clarke [suEXEC ProcessGroup mode] Proofreading |
litespeed_wiki:php:which_php_setup_am_i_using [2019/03/19 16:16] Lisa Clarke [Config PHP and suEXEC in Cpanel] Updated broken link |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ===== Should I use SuEXEC or non-SuEXEC? ===== | + | ====== PHP SuEXEC mode ====== |
| - | If you run shared hosting services with a control panel, it is necessary to use SuEXEC mode for security reasons. In SuEXEC mode, each PHP process will run as the owner of the virtual host's document root. If you only host your own domains, you can use SuEXEC but doing so may not be necessary. | + | suEXEC is an Apache execution method for CGI and SSI programs that makes executing PHP scripts more secure by running each PHP process as the owner of a particular account instead of as the user running the web server. This means that even if one user on a server is compromised, PHP scripts run from their accounts will not have access to other users' files. suEXEC has long been a basic feature in shared hosting environments. |
| - | To enable SuEXEC for cPanel, Plesk, or another control panel, ''Admin Console -> Server -> Server General -> Using Apache Configuration File -> PHP suEXEC'' should be set to ''Yes''. | + | LiteSpeed Web Server is capable of using this execution method directly when configured to read Apache configuration files. When running LiteSpeed Web Server (native),a similar implementation, called **ExtApp Set UID Mode**, is available at the Virtual Host level. suEXEC like behavior can also be achieved at the External Application level using the **Run as User** and **Run as Group** settings. |
| + | ===== PHP SuEXEC enabled on control panel by default ===== | ||
| + | If you run shared hosting services with a control panel, it is necessary to use SuEXEC mode for security reasons. Our LSWS installation script will enable PHP SuEXEC by default for all control panels hence LSWS will run PHP SuEXEC out of the box. In SuEXEC mode, each PHP process will run as the owner of the virtual host's document root. | ||
| - | ===== Which PHP setup am I using? ===== | + | To manually enable SuEXEC on LSWS for cPanel, Plesk, or another control panel, **Configuration > Server > General > Using Apache Configuration File > PHP suEXEC** should be set to ''Yes''. However, Enabling PHP suEXEC for the control panels is default setup during the installation and you have no need to manually change it here. Once it is set, generally you should not make change anymore to avoid permission problem, since PHP SuEXEC will generally run as ''user:user'' while non-PHP SuEXEC will run as ''nobody:nobody''. |
| - | LiteSpeed Web Server comes with [[https://www.litespeedtech.com/products/litespeed-sapi/php/guide-to-suexec-setups|a number of PHP setups]]. Less experienced users may be confused as to which PHP setup they are using. Follow the steps in this wiki to determine which PHP setup you're using. | + | ===== Enable PHP SuEXEC for LiteSpeed Web Server (Native) or OpenLiteSpeed ===== |
| + | To enable SuEXEC for LSWS native or on OpenLiteSpeed, you will need to create external apps (name should be unique and different than server level external apps and other virtual host external apps, for example, lsphp_$vhost; also set it to run as username:usergroup to implement PHP SuEXEC) and script handler pointing to the newly created external app under each virtual host. | ||
| - | === Prerequisites === | + | ===== PHP Process Modes: ProcessGroup/Daemon/Worker ===== |
| - | This wiki is for LSWS users using LSAPI (the default and recommended SAPI for PHP). | + | LiteSpeed Web Server offers a number of different [[litespeed_wiki:php:process-mode|PHP process modes]] for the various needs and goals of shared hosting providers: [[litespeed_wiki:php:process-mode#processgroup_mode|ProcessGroup mode]], [[litespeed_wiki:php:process-mode#daemon_mode|Daemon mode]], and [[litespeed_wiki:php:process-mode#worker_mode|Worker mode]]. |
| + | ===== Which PHP setup am I using? ===== | ||
| + | |||
| + | LiteSpeed Web Server comes with [[litespeed_wiki:php:process-mode|a number of PHP process modes]]. Less experienced users may be confused as to which PHP setup they are using. Follow the steps in this wiki to determine which PHP setup you're using. | ||
| ==== suEXEC or non-suEXEC? ==== | ==== suEXEC or non-suEXEC? ==== | ||
| * Is the [[https://www.litespeedtech.com/docs/webserver/config/general#phpSuExec|PHP suEXEC setting]] set to ''Yes'' or ''User's Home Directory Only''? If so, then you are using suEXEC. If not, then you are not using suEXEC. | * Is the [[https://www.litespeedtech.com/docs/webserver/config/general#phpSuExec|PHP suEXEC setting]] set to ''Yes'' or ''User's Home Directory Only''? If so, then you are using suEXEC. If not, then you are not using suEXEC. | ||
| - | ==== Which suEXEC mode am I using? ==== | + | ==== Which process mode am I using? ==== |
| - | + | ||
| - | * Is the [[https://www.litespeedtech.com/docs/webserver/config/extapps#runOnStartUp|Run on Start Up setting]] set to ''suEXEC Daemon''? If so, then you are running [[https://www.litespeedtech.com/docs/litespeed-sapi/php-lsapi/suexec-daemon-mode|suEXEC Daemon mode]]. If not, then you are running [[https://www.litespeedtech.com/docs/litespeed-sapi/php-lsapi/suexec-worker|suEXEC Worker mode]]. (Also see next step.) | + | |
| - | * Do you have an [[https://www.litespeedtech.com/docs/litespeed-sapi/php-lsapi/configuration|LSPHP_ProcessGroup on]] directive in your Apache configuration files? If so, then users with that configuration are using [[https://www.litespeedtech.com/docs/litespeed-sapi/php-lsapi/suexec-processgroup|suEXEC ProcessGroup]]. (This can be set at the server or virtual host level.) | + | |
| - | * Is your [[https://www.litespeedtech.com/docs/webserver/config/extapps#instances|Instances setting]] set to ''1''? If so, you are running ProcessGroup. If not, you are running Worker. (These setups are explained in the Environment Variables section of the [[https://www.litespeedtech.com/docs/litespeed-sapi/php-lsapi/configuration|PHP LSAPI Configuration documentation]].) | + | |
| - | + | ||
| - | ===== PHP suEXEC Setups===== | + | |
| - | + | ||
| - | LiteSpeed Web Server offers a number of different PHP suEXEC setups for the various needs and goals of shared hosting providers: suEXEC Worker mode, suEXEC Daemon mode, and suEXEC ProcessGroup mode. | + | |
| - | + | ||
| - | ==== suEXEC Worker mode==== | + | |
| - | + | ||
| - | suEXEC Worker: Standard suEXEC PHP with LSAPI. Creates new processes when needed. PHP suEXEC Worker is compatible with custom php.ini files, including CloudLinux’s CageFS php.ini files, and thus allows the use of CloudLinux's PHP Selector. suEXEC Worker is incompatible with opcode caching. suEXEC Worker is enabled by default when PHP suEXEC is configured in your Apache configs. | + | |
| - | + | ||
| - | ==== suEXEC Daemon mode==== | + | |
| - | + | ||
| - | suEXEC Daemon mode is automatically set up to run processes as the site owner, makes great use of opcode caching, and spawns processes dynamically, using resources when and where you need them. suEXEC Daemon mode does not allow a customized per-user php.ini. If a user has a customized php.ini, LiteSpeed WebServer will automatically switch to suEXEC Worker mode (LiteSpeed's default suEXEC setup) at the server level. Because of the incompatibility with custom php.ini's, suEXEC Daemon mode is not compatible with CloudLinux's PHP Selector. | + | |
| - | + | ||
| - | To set up suEXEC Daemon mode, just adjust your server-level LSPHP external application settings. ''WebAdmin console > Configuration > External App > your LSPHP external application: Set Auto Start'' to ''Yes'' and ''Run On Start Up'' to ''suEXEC Daemon''. | + | |
| - | + | ||
| - | ==== suEXEC ProcessGroup mode==== | + | |
| - | + | ||
| - | suEXEC ProcessGroup mode allows for LiteSpeed's most powerful suEXEC opcode caching. Each process group has its own parent process which makes PHP suEXEC ProcessGroup compatible with custom php.ini files. A custom php.ini allows the use of CloudLinux’s PHP Selector. ProcessGroup is set through a directive in your httpd.conf files at either the server or virtual host level. (See the Configuration section.) Using this directive at the virtual host level allows you to decide which users get a personal opcode cache. | + | |
| - | + | ||
| - | Prerequisites: | + | |
| - | + | ||
| - | ''Auto Start'' (in ''WebAdmin console > Configuration > External App > your external application'') must be set to ''Yes'' or ''Through CGI Daemon''. Setting Auto Start to ''Through CGI Daemon'' may save resources by not starting parent processes for idle process groups at startup. | + | |
| - | If you wish to use suEXEC Daemon mode for some users while using ProcessGroup for others, change ''Run On Start Up'' (in ''WebAdmin console > Configuration > External App > your external application'') to ''suEXEC Daemon''. If ''Run On Start Up'' is set to ''suEXEC Daemon'', ProcessGroup will override Daemon mode wherever ProcessGroup is enabled. | + | |
| - | If ''Run On Start Up'' (in ''WebAdmin console > Configuration > External App > your external application'') is set to ''No'', LSWS will start a parent process for each process group only when a user receives traffic. This is recommended. Setting ''Run On Start Up'' to ''Yes'' may result in errors. When ''Run on Start Up'' is set to ''yes'' or ''suEXEC Daemon'', ''Max Idle Time'' (lsphp parent process max idle time) default value is 10. You can even set it to a very large number like ''3600'' so that PHP will not be stopped by the server in short time. Don't set "Max Idle time" to "-1", since it will be converted to default 30 seconds for process group. "Run on start up" won't keep LSPHP parent process running and LSPHP parent process will still follow the timeout. | + | |
| - | + | ||
| - | In control panel environment, processGroup is enabled by placing the directive ''LSPHP_ProcessGroup'' in an httpd.conf file. This can be done at the server or virtual host level. If done at the server level, all virtual hosts will use ProcessGroup. If done at the virtual host level, only that virtual host will use ProcessGroup. While in LSWS native environment, processGroup can be enabled by setting ''Instances'' to ''1'' and setting ''LSAPI_CHILDREN'' to a number greater than ''1'', such as ''15''. | + | |
| - | + | ||
| - | Example configuration for control panel environment: | + | |
| - | + | ||
| - | <code> | + | |
| - | <IfModule LiteSpeed> | + | |
| - | LSPHP_ProcessGroup on | + | |
| - | LSPHP_Workers 15 | + | |
| - | </IfModule> | + | |
| - | </code> | + | |
| - | + | ||
| - | Note the ''<IfModule LiteSpeed>''. The two directives, ''LSPHP_ProcessGroup'' and ''LSPHP_Workers'', are LiteSpeed-specific directives. Apache will not understand them and may crash if they are not protected. | + | |
| - | + | ||
| - | Additional configurations: | + | |
| - | + | ||
| - | ''LSPHP_Workers'' sets the maximum number of child processes that the parent process can spawn. This is optional. If set, it will override the ''PHP suEXEC Max Conn'' setting (in ''WebAdmin console > Configuration > Server > General > Using Apache Configuration File''). | + | |
| - | Per-user opcode cache size is set in your php.ini file. The steps to set this depends on which opcode cache you’re using. | + | |
| - | The ''Max Idle Time'' setting (in ''WebAdmin console > Configuration > External App > your external application'') will control how long before idle parent processes are killed. | + | |
| - | + | ||
| - | Special notes for use with cPanel: | + | |
| - | + | ||
| - | The ''ProcessGroup'' directive should be put in an include file, otherwise it will be overwritten when you upgrade WHM. | + | |
| - | When configuring ''ProcessGroup'' at the server level, the directive should be placed in ''/usr/local/apache/conf/includes/pre_virtualhost_global.conf''. | + | |
| - | When configuring ''ProcessGroup'' at the virtual host level, the directive should be placed in a virtual host-level include file. | + | |
| - | Guides for adding include files can be found on [[https://confluence2.cpanel.net/display/EA/Modify+Virtualhost+Containers+With+Include+Files|this page]] from cPanel's site. | + | |
| - | + | ||
| - | Process Group Mode is similar to Apache php-fpm mode. The difference is: with Apache, the parent process of php-fpm is not controlled by Apache, and it keeps running; with LiteSpeed, LiteSpeed uses LSAPI, and the PHP will exit if idle for a while (in a shared hosting environment). For LSWS 5.2.8 and lower versions, PHP processes will stop when LSWS restarts, and the opcode cache will be reset. Starting from LSWS 5.3RC2 and above, LSPHP will run in detached mode and an LSWS restart //won't// stop PHP processes. The LSPHP parent will just follow the timeout where [[https://www.litespeedtech.com/docs/webserver/config/extapps/lsapi#extMaxIdleTime|"Max Idle time"]] is set. | + | |
| - | + | ||
| - | References: | + | |
| - | + | ||
| - | https://www.litespeedtech.com/products/litespeed-sapi/php/guide-to-suexec-setups | + | |
| - | + | ||
| - | https://www.litespeedtech.com/products/litespeed-sapi/php/suexec-worker | + | |
| - | + | ||
| - | https://www.litespeedtech.com/products/litespeed-sapi/php/suexec-daemon-mode | + | |
| - | https://www.litespeedtech.com/products/litespeed-sapi/php/suexec-processgroup | + | * Is the **[[https://www.litespeedtech.com/docs/webserver/config/extapps#runOnStartUp|Run on Start Up setting]]** set to ''Yes (Daemon mode)''? If so, then you are running [[litespeed_wiki:php:process-mode#daemon_mode|Daemon mode]]. If not, then you are running [[litespeed_wiki:php:process-mode#worker_mode|Worker mode]]. |
| + | * Do you have an ''[[litespeed_wiki:php:lsapi-environment-variables#lsphp_processgroup|LSPHP_ProcessGroup on]]'' directive in your Apache configuration files? If so, then users with that configuration are using [[litespeed_wiki:php:process-mode#processgroup_mode|ProcessGroup mode]]. (This can be set at the server or virtual host level.) | ||
| + | * Is **[[https://www.litespeedtech.com/docs/webserver/config/extapps#instances|Instances]]** set to ''1''? If so, you are running [[litespeed_wiki:php:process-mode#processgroup_mode|ProcessGroup mode]]. If not, you are running [[litespeed_wiki:php:process-mode#worker_mode|Worker mode]]. These setups are explained further in [[litespeed_wiki:php:process-mode|PHP Process Modes]].) | ||
| Line 89: | Line 33: | ||
| Please refer to Cpanel documentation: | Please refer to Cpanel documentation: | ||
| - | https://documentation.cpanel.net/display/ALD/Configure+PHP+and+suEXEC | + | https://documentation.cpanel.net/display/ALD/MultiPHP+Manager+for+WHM |