Re: ZFS ACL and apache suexec

Martijn,

This is an apache problem, not a FastCGI problem.  It certainly looks like the 
httpd process is getting an error when it tries to stat() or chdir() to get 
access to /php-fastcgi/php5-cgi/index.php because you never see a log message 
about an exec failure.  Some well placed truss's on the httpd processes might 
show you what exactly is failing (you can start httpd in a truss -f, and then 
wade through the output to look for your failure).

The way we got around the group problem was to make the top-level directory 
owned by httpd and the users' group.  The permissions on that were set to 4770. 
Underneath, everything was owned by the user, and the perms were generally 
4755/644 so httpd could see everything, but you'd have security controlled at 
the top level.

Good luck,

David.

-----

On Fri, 21 Mar 2008, Martijn de Munnik wrote:

> Hi,
>
> I'm trying to get my apache webserver as secure as possible. The
> server is used for multiple virtual hosts and I want to isolate each
> vhost host. I used this document as a guide
>
> http://snippets.dzone.com/posts/show/81
>
> everything works fine. Each vhost is under a separate unix user/group
> and apache is running as nobody/nobody. The user nobody is also in all
> the usergroups but Solaris has a limit of 32 additional groups a user
> can be in. So there's my problem. I though the solution would be ZFS
> ACL's and tried that. The user nobody can navigate in the public_html
> directory of the vhost (nobody is not in the usergroup anymore) and
> apache shows HTML files. But when I want to show php files something
> goes wrong:
>
> Forbidden
> You don't have permission to access /php-fastcgi/php5-cgi/index.php on
> this server.
> Additionally, a 403 Forbidden error was encountered while trying to
> use an ErrorDocument to handle the request.
>
> Nothing shows up in the logs. When I run a php script on a vhost which
> is configured the old way (nobody is in the usergroup) I get lines
> like these:
>
> [Fri Feb 29 08:03:57 2008] [warn] FastCGI: (dynamic) server "/opt/csw/
> apache2/share/htdocs/suexec/xxxxxxx.nl/php5-cgi" (uid 10003, gid
> 10001) started (pid 8253)
>
> All the config files and scripts are the same so the problem should be
> file permissions I guess, any ideas?
>
> thanks,
>
> Martijn de Munnik
>
>
> ___________________________________
> fastcgi-developers mailing list
> http://fastcgi.com/fastcgi-developers/
>
___________________________________
fastcgi-developers mailing list
http://fastcgi.com/fastcgi-developers/