chroot + suexec + mod_fastcgi + php - It appears to be working.

If anyone is interested, Gasior and I have basically got this working. (I
think he does now...)  I am using apache 2.x, I believe he is on apache 1.x

He is using a different wrapper, but I modified chroot + suexec, by putting
in debug statements and stracing fcgi-pm you can see how the default suexec
+ chroot doesn't work,  you have to comment out the check ownership, and
something else I believe.  It will depend on your specific wrapper, but if
you are getting segfaults and processes not starting, you can debug it that
way fairly easily.

Then, to get php to work, because the full paths are sent in the
environment, not the chroot()'d path, you have to set :

cgi.fix_pathinfo=0;

and

doc_root = <your doc_root>

For instance, if your setup is /www/h/o/host.com/html <-- chroot's document
root, you set "doc_root = /html" in php.ini.

For something like /sites/host.com/www you'd set "doc_root = /www".

That appears to make php look for the script with the right path, some
variables are different than they are with just suexec and cgi, but such is
life, there's probably a way to fix this, but it looks rather difficult,
I'm open to anyone's thoughts or suggestions.

Your vhost config needs to have something like this in it, of course it
depends on how you choose to do it.  The rest of the config stuff in
httpd.conf is mainly up to you. It seems to work better setting
-singleThreshold 0 :

######### FASTCGI #########
<IfModule mod_fastcgi.c>
# These are commented out because I found I didn't need them,
# but perhaps you will?  They seem to work on Gasior's setup.
#
#    RewriteEngine On
#    RewriteCond %{REQUEST_FILENAME} !^/cgi/php-fcgi
#    RewriteRule ^/(.*)\.php /$1\.php

    ScriptAlias /cgi/ /www/h/o/host.com/usr/bin/

    AddHandler php-fastcgi .php
    AddHandler php5-fastcgi .php5

    <Location /cgi/php-fcgi>
        SetHandler fastcgi-script
    </Location>
    <Location /cgi/php5-fcgi>
        SetHandler fastcgi-script
    </Location>

    Action php-fastcgi /cgi/php-fcgi
    Action php5-fastcgi /cgi/php5-fcgi

    AddType application/x-httpd-php .php
    AddType application/x-httpd-php .php5

</IfModule>
######### END FASTCGI #########


This allows fastcgi to find the binaries it needs outside of document root
and spawn the correct handler.  I believe you have to specify the full path
in the scriptalias, because the chroot()'ing as not been done yet.  With
this setup you can also use eAccelerator (and I assume APC.)

And each handler for each vhost is setuid/setgid/chroot, just like my
normal CGI, and since it is associated with the path in a similar way to
CGI, you don't have to change too much.  Also, if you leave out this vhost
config, you can still run other vhosts as regular CGI. (As long as you
associated .php with /usr/bin/php in this setup, I use binfmt_misc for
that.) And if you include the IfModule, you should be able to just comment
out the main statements from httpd.conf and go back to your old config if
this causes problems for you.

Also, you must be very careful with mod_rewrite rules, they can cause
fastcgi+php not to work, or in one case, even if a page appears to load
correctly in a browser, if you view it with lynx, you see it is throwing a
404 for every single page!! Heh, but this can all be corrected by fixing or
changing your mod_rewrite rules.

This seems to be working fine for me so far, I saw some problems initially,
fastcgi seems to handle things a little bit differently than regular php
CGI.  It's been running for several days now and hasn't stopped working for
any of the several vhosts I am using it on.

It is also a considerably faster, I did several benchmarks, but nothing
complete enough to give you an exact figure, eaccelerator is a great bonus,
but the largest improvement is in CPU usage.  Loading php as cgi for every
script is a massive load, running fastcgi dramatically reduces CPU usage
per page load, it's really amazing.

I'll post again if I have any problems, also, feel free to offer
suggestions or any further information you might have.  If I have done
something incorrectly, please, let me know.

Thanks!
Ben

___________________________________
fastcgi-developers mailing list
http://fastcgi.com/fastcgi-developers/