Enable SUPH return ERROR 500

[prgs1971]

In Webserver Config i have done:

PHP Branch:
-selected php54_(as_5.4.17)
- hit update

Php Type
- selected suphp
- hit update

Fix 'ownership' And 'permissions'
- selected fix-All

After all this i have rebooted the server.

Now i am able to reach exanple.com, but get error 500 when try to reach cp.example.com

My suphp log show:

Code: [Select]

[Sun Aug 18 16:33:23 2013] [warn] UID of script "/home/kloxo/httpd/cp/index.php" is smaller than min_uid
Did i miss anything?

How to fix this?

[MRatWork]

Better not using suphp for primary php (because suphp used by secondary php).

[MRatWork]

Or you can modified /etc/suphp.conf where change 'min_uid=500' to 'min_uid=48'

[prgs1971]

I don't use secondary PHP.

What will the best to use, regarding security in first place and performance/stability in second place?

[MRatWork]

All php-type already secure because unsecure php-type (mod_php) already remove from panel!.

[prgs1971]

Or you can modified /etc/suphp.conf where change 'min_uid=500' to 'min_uid=48'

In Official kloxo that i use in my production server is not  necessary to change the above  suggestion.

/etc/suphp.conf file in production server

Code: [Select]

[global]
logfile=/var/log/httpd/suphp_log
loglevel=info
webserver_user=apache
docroot=/
env_path=/bin:/usr/bin
umask=0022
min_uid=500
min_gid=48

; Security options
allow_file_group_writeable=true
allow_file_others_writeable=false
allow_directory_group_writeable=true
allow_directory_others_writeable=false

;Check wheter script is within DOCUMENT_ROOT
check_vhost_docroot=false

;Send minor error messages to browser
errors_to_browser=false

[handlers]
;Handler for php-scripts
x-httpd-php="php:/usr/bin/php-cgi"

;Handler for CGI-scripts
x-suphp-cgi="execute:!self"
/etc/suphp.conf file in test server

Code: [Select]

[global]
logfile=/var/log/httpd/suphp_log
loglevel=info
webserver_user=apache
docroot=/
env_path=/bin:/usr/bin
umask=0022
min_uid=500
min_gid=48

; Security options
allow_file_group_writeable=true
allow_file_others_writeable=false
allow_directory_group_writeable=true
allow_directory_others_writeable=false

;Check wheter script is within DOCUMENT_ROOT
check_vhost_docroot=false

;Send minor error messages to browser
errors_to_browser=false

[handlers]
;Handler for php-scripts
x-httpd-php="php:/usr/bin/php-cgi"
x-httpd-php52="/opt/php52s/etc/php52s-cgi.sh"

;Handler for CGI-scripts
x-suphp-cgi="execute:!self"

;;; MR -- for using php52 just enough add 'AddHandler x-httpd-php52 .php' on .htaccess.
;;; it's make possible running 'dual php' on server!

Can the problem be related with the other differences between the 2 files?

[MRatWork]

It's because I am forgot when change ownership for /home/kloxo/httpd from lxlabs to apache.

[prgs1971]

All php-type already secure because unsecure php-type (mod_php) already remove from panel!.

According what is stated in the second page of this pdf http://www.worldhostingdays.com/downloa ... tag2c1.pdf, you have to concern about the security of some of the options available in Kloxo-MR.

[prgs1971]

It's because I am forgot when change ownership for /home/kloxo/httpd from lxlabs to apache.

Sorry i don't understand well what you are trying to say.

Maybe you are trying to say that the ownership of /home/kloxo/httpd should be lxlabs ?

Recursevely ?

[MRatWork]

Old Kloxo (Kloxo official) set lxlabs as ownership for /home/kloxo/httpd and then I was change to apache (for certain reason) but forgot to adjustment suphp.conf.

[prgs1971]

So what you are saying is that you forgot to change the min_uid=500 to min_uid=48 in the /etc/suphp.conf file, when we select to use suphp in the Kloxo-MR Webserver Config.

Therefore the file /etc/suphp.conf should look like this:

Code: [Select]

[global]
logfile=/var/log/httpd/suphp_log
loglevel=info
webserver_user=apache
docroot=/
env_path=/bin:/usr/bin
umask=0022
; by prgs1971
; fix bug http://forum.mratwork.com/posting.php?mode=reply&f=5&t=19267
;min_uid=500
min_uid=48
min_gid=48

; Security options
allow_file_group_writeable=true
allow_file_others_writeable=false
allow_directory_group_writeable=true
allow_directory_others_writeable=false

;Check wheter script is within DOCUMENT_ROOT
check_vhost_docroot=false

;Send minor error messages to browser
errors_to_browser=false

[handlers]
;Handler for php-scripts
x-httpd-php="php:/usr/bin/php-cgi"
x-httpd-php52="/opt/php52s/etc/php52s-cgi.sh"

;Handler for CGI-scripts
x-suphp-cgi="execute:!self"

;;; MR -- for using php52 just enough add 'AddHandler x-httpd-php52 .php' on .htaccess.
;;; it's make possible running 'dual php' on server!


[MRatWork]

Yes and then try it.

[prgs1971]

Now it works with that new configuration.

Can you explain me why you don't use lxlabs as the user for run kloxo and instead you prefer to use the generic one apache?

[MRatWork]

It's because something lxlabs as user will be remove and maybe change to mratwork or other user. So, apache only as transition user.

[prgs1971]

For security reasons is always good idea to not use apache to run the programs or i am wrong?