suPHP: apt-get or manual install

Hans has written two excelent howto's about installing and configuring suPHP for use with ISPConfig on Debian Sarge (http://www.howtoforge.com/suphp_debian_ispconfig) and Etch (http://www.howtoforge.com/suphp_debian_etch_ispconfig). Thank you for that Hans. However, an "apt-cache search suphp" on my server reveals the packages libapache2-mod-suphp (for Apache) and libapache2-mod-suphp (for Apache 2). I guess like many others, I prefer to install software from the Debian repository using aptitude, in order to keep my server easier to maintain. My question now is: is there a specific reason for (w)getting and making suPHP by hand, as instructed in Hans's howto's, or can one just as well "apt-get install" it? In the latter case it's interesting to know exactly which steps can be skipped from in the current howto's.

 

Hi,

I am not sure, but i think that when you use apt-get or aptitude , suPHP will be installed as a module for Apache2, not as a DSO.

You can list the installed modules for Apache2 on your system with:

apache2 -l


Within my howto's, i installed suPHP as a Dynamic Shared Object (DSO), which means that it exists separately from the main httpd binary file. This is the recommended way and is mentioned also on http://www.suphp.org/

I hope that Falko and/or Till can tell you more about the different methods and their advantages/disadvantages.

 

Thanks Hans. So far no response from Falko or Till yet. I guess the guys are quite busy. Maybe this post will get their attention.

May be you, or anyone else for that matter, can also explain why one would use suPHP instead of suEXEC to run php applications? I searched around a bit but I can't find a clear and definite answer. Or should I start a separate, dedicated topic fro that?

 

Thanks Till. I'll stick with the Debian package then. That will also keep my support guys happy

Better ISPConfig integration and custom php.ini per website with suPHP sounds good. So if I correctly read between the lines, there are no specific technical (dis)advantages to using one or the other?

 

Hi,

@till:
The latest versions of ISPConfig support suPHP, but I still have to install it manually, right? What happens when there is an update for ISPConfig? Does it affect an installation of suPHP?

@pjdevries:
Have you tested the debian pakage? Is it working?

@all:
How save is it, installing su PHP in a produtcive invironment? I can't afford it, that anything goes wrong. Will I have to change any permissions afterwards in my php projects?

Thanks for your help,

melwood

 

My experience with suPHP

@melwood,

Earlier this year, i've done a migration from phpmod to suphp on my Debian Etch server, which is a production server.
If you take exactly the steps and in the same order as described within my howto, you are able to do the same.
The link is: http://www.howtoforge.com/suphp_debian_etch_ispconfig

I did not test the suPHP by using the Debian package.
ISPConfig will automaticly detect if it runs in suPHP mode, so you don't have to worry about that when you perform an update to a new future release.

Probably when you switch to suphp, for some sites an internal server error 500 occurs, because some sites are not compatible with the suPHP mechanism.
For example: If you have a TYPO3 core installed within /var/www and the TYPO3 site itself has been installed within /var/www/webX/web/, suPHP will not work. But for such situations, there is a solution mentioned at the end within my Howto.

If you start suPHP, check if the folders within the webs has been chmod to 755 or 775, otherwise php scripts within those folders will not execute.
The php-scripts itself can be chmod to 664 or 644.

 

Hi Hans,

one more question:

When php scripts run under the admin user of the website instead of the system user www-data, are there any problems with a central installation of PEAR?

I have one standard installation of PEAR on my server (debia etch), that all webs can use. But will they have enough rights to still do this?

melwood

 

How can I set a custom php.ini?

Now I'm use from /etc/php5/cgi/php.ini
register global - off
php safe mode - on
for every site.

 

I do not have experience with a central installation of PEAR in combination with suPHP.
So, i can not help you at this point.

 

I guess you can still use them

 

@melwood

I didn't get around to testing the Debian package yet. Could take some time because I have limited time and some other ISPConfig issues to resolve first.

@Hans

Currently I'm experimenting with a central Gallery 2 installation on my server. I guess what you describe for Typo3 also applies to Gallery and other, similar applications.

 

Yes, that is correct.
The Gallery2 core has been installed on one of my servers and it makes use of php5mod, not suPHP.
I think in general when a site uses a core outside it's own web, the suphp mechanism will not work.

 

In an attempt to answer my own question, I decided to try to create a custom suPHP package to ease the installation of suPHP for use with ISPConfig. Not without problems though, so I started a new thread suPHP in custom Debian package.

 

You can get the package here: http://www.howtoforge.com/forums/showthread.php?p=77187#post77187