How to install and configure suPHP

This tutorial is about how to install and configure suPHP. I know that they exist more tutorials about this but even though I'll write it because it took me a lot of time for me to make it work, and I want to explain how it finally work for me.
I made this installation and configuration with Fedora 16 and httpd.

What the suPHP module does is define which user and group will execute the PHP scripts. This is established inside one or more VirtualHost. This means that we can have multiple users for each one of our sites. They can even be executed by root but this is not advisable.

Now let's see how to install it:

It can be with yum or in case of Debian based distros with apt-get, but at least with Fedora and other similar distros I recommend to download the suPHP module from the official site. Here is the link:

Now that we have downloaded the package, we untar it:




tar -xzvf suphp-*.tar.gz

We get inside the folder that is generated after de untaring and we configure the installation before compiling it:

./configure --with-apxs=/usr/sbin/apxs --with-apr=/usr/bin/apr-1-config --with-apache-user=apache --with-logfile=/var/log/httpd/suphp_log --with-setid-mode=paranoid --sysconfdir=/etc --enable-SUPHP_USE_USERGROUP=yes

What do the parameters mean:

--with-apxs=/usr/sbin/apxs: This establishes where is located apxs (this is where mine is located but it can be different in your distro, so first verify where it is yours). Apxs is an Apache utility that helps in the construction of modules.

--with-apr=/usr/bin/apr-1-config: This establishes where is located apr-1-config. Apr is the Apache Portable Runtime configuration utility.

--with-apache-user=apache: This establishes with what user is running actually Apache or httpd. (I wrote Apache, but you may have another user running your service, so first verify it).

--with-logfile=/var/log/httpd/suphp: This establishes where the logs for suPHP are going to be saved. It can be a different location as long as the user that runs Apache or httpd has writing permissions for that directory.

--with-setid-mode=paranoid: This establishes with what mode will be executed suPHP. Below you'll see the description of each mode.

--sysconfdir=/etc: This establishes the directory where suPHP will search for the configuration files. At least it most be readable by the Apache or httpd user.

--enable-SUPHP_USE_USERGROUP=yes: This enables the use of suPHP_UserGroup directive inside he Apache/httpd configuration. suPHP_UserGroup defines the user and group that will run the PHP scripts of Apache/httpd or just some VirtualHost.

Modes for executing suPHP:

Owner: The scripts will be executed with owner as the user and the owner group as the group.

Force: The scripts will be executed as the user and group established in the Apache/httpd configuration under the suPHP_UserGroup directive even if the owner and group of that script is other user and group. (suPHP doesn't recommend the use of this mode).

Paranoid: The scripts will be executed as the user and group established in the Apache/httpd configuration under the suPHP_UserGroup directive only if the user and group are the same as the owner and owner group of the script.

Now let's continue with the installation, now let's compile:




make

If any error appeared we proceed with installation:




make install

Configuration of suPHP in Apache/httpd:

We have to edit or if it doesn't exist, create the file suphp.conf inside the directory established at the --sysconfdir parameter:

[global] logfile=/var/log/suphp.log #Location of log webserver_user=apache #User running Apache/httpd ###Security options allow_file_group_writeable=true #Allows or denies file writing to group allow_file_others_writeable=false #Allows or denies file writing to other users allow_directory_group_writeable=true #Allows or denies directory writing to group allow_directory_others_writeable=false #Allow or denies directory writing to other users check_vhost_docroot=true #This option establishes that only scripts under the DOCROOT #established in the Apache/httpd configuration or inside the VirtualHosts env_path=/bin:/usr/bin #Environment variable path (may also be different for your distro) umask=077 #The umask that will be applied to establish the default permissions of files #and directories generated by the scripts. min_uid=0 #The minimum UID to run the scripts. min_gid=0 #The minimum GID to run the scripts. ####In this case I chose 0 because I needed to run my scripts as root but it is not #advisable, the minimum recommended UID nad GID are 1000, where the non-system users #start. [handlers] application/x-httpd-php="php:/usr/bin/php-cgi" #Establishes what application will #interpret the scripts, the php-cgi path goes here. 


The next step in configuration:

For httpd on Fedora or similars:

Edit the file /etc/httpd/conf.d/suphp.conf with this:


LoadModule suphp_module modules/mod_suphp.so suPHP_Engine on AddType application/x-httpd-php .php suPHP_AddHandler application/x-httpd-php 

And the configuration file for httpd in the VirtualHost section has to look like this (using as example the user rukia):


<VirtualHost *:8080> suPHP_UserGroup rukia rukia #Establishes the user and group to run the scripts DocumentRoot /var/www/html #Route where the content to be shown by the web server is stored #(this route can be changed as long as it has the right permissions) </VirtualHost> 

For Apache on Ubuntu or similars:

Add the first configuration text from above inside the VirtualHost that will use suPHP.

So the configuration for a VirtualHost in Apache on Ubuntu to run scripts as rukia will be:

LoadModule suphp_module /usr/lib/apache2/modules/mod_suphp.so <VirtualHost *:8080> suPHP_Engine on AddType application/x-httpd-php .php suPHP_AddHandler application/x-httpd-php suPHP_UserGroup rukia rukia DocumentRoot /var/www/html </VirtualHost> 

And with this ends the installation and configuration of suPHP now we just have to restart the Apache/httpd service.

We can try our configuration for example with a script that creates a file inside our DOCROOT:

PHP code:

system("touch prueba.txt"); 

Any doubt please comment.