ozgreg
08-17-2005, 09:12 PM
What is phpsuexec and why should I use it??
When PHP runs as an Apache Module it executes as the user/group of the webserver which is usually "nobody". Under this mode, files or directories that you require your php scripts to write to need to have 777 permissions (read/write/execute at user/group/world level). This is not very secure because besides allowing the webserver to write to the file it also allows anyone else to read or write to the file.
With PHP running as CGI with suexec enabled your php scripts now execute under your user/group level. Files or directories that you require your php scripts to write to no longer need to have 777 permissions. In fact, having 777 permissions on your scripts or the directories they reside in will not run and will instead cause a 500 internal server error when attempting to execute them to protect you from someone abusing your scripts. Your scripts and directories can have a maximum of 755 permissions (read/write/execute by you, read/execute by everyone else). PHP running as CGI/suexec is much more secure than the older Apache module method.
What is the downside to using phpsuexec?
Performance: Since php is running via a CGI interpreter which is going to add an overhead to your CPU
PHP Scripts: Some scripts do not like the phpsuexec CGI environment as it changes certain PHP internal system variables causing them to fail.
.htaccess: Manipulating php settings is not possible (use a local php.ini instead)
Security: Files / Directory permissions given a world read+write+execute 777 will not work, instead these files will need to be changed to 755
PHP Accelerator: Zend does still function however other popular Accelerators such as eAccelerator do not.
urls: Variables in URL not encoded as regular variables that is variables inside the URL path, not expressed like view.php?=view will not work.
What is the upside to using phpsuexec?
Security: it is far more secure without global world write permissions.
File Ownership: Files are owned by the user/usergroup rather than nobody/nobody
How do I enable it?
You will need to recompile Apache with PHPsuexec enabled.
When PHP runs as an Apache Module it executes as the user/group of the webserver which is usually "nobody". Under this mode, files or directories that you require your php scripts to write to need to have 777 permissions (read/write/execute at user/group/world level). This is not very secure because besides allowing the webserver to write to the file it also allows anyone else to read or write to the file.
With PHP running as CGI with suexec enabled your php scripts now execute under your user/group level. Files or directories that you require your php scripts to write to no longer need to have 777 permissions. In fact, having 777 permissions on your scripts or the directories they reside in will not run and will instead cause a 500 internal server error when attempting to execute them to protect you from someone abusing your scripts. Your scripts and directories can have a maximum of 755 permissions (read/write/execute by you, read/execute by everyone else). PHP running as CGI/suexec is much more secure than the older Apache module method.
What is the downside to using phpsuexec?
Performance: Since php is running via a CGI interpreter which is going to add an overhead to your CPU
PHP Scripts: Some scripts do not like the phpsuexec CGI environment as it changes certain PHP internal system variables causing them to fail.
.htaccess: Manipulating php settings is not possible (use a local php.ini instead)
Security: Files / Directory permissions given a world read+write+execute 777 will not work, instead these files will need to be changed to 755
PHP Accelerator: Zend does still function however other popular Accelerators such as eAccelerator do not.
urls: Variables in URL not encoded as regular variables that is variables inside the URL path, not expressed like view.php?=view will not work.
What is the upside to using phpsuexec?
Security: it is far more secure without global world write permissions.
File Ownership: Files are owned by the user/usergroup rather than nobody/nobody
How do I enable it?
You will need to recompile Apache with PHPsuexec enabled.