Server support blog

There are plenty of tutorials on the web. Tons and tons.

However when I had to create working configuration and put together Virtualmin template most of these instruction just didn’t work properly. After some time I’ve came up with my own working configuration and proper Virtualmin apache template for CentOS.

As a bonus we’ll have per-user php.ini and apache2 worker MPM which is a little bit faster and less resource hungry then traditional prefork MPM.

First, I turned for instructions to HowTo Forge, which is proven to be an excellent resource, but unfortunately, instructions they provided are a little bit incomplete. Below is my instructions collected from various sources and tested numerous times.

1. Install rpms – httpd, php-common, mod_fcgid, additional php modules you might need.
2. Open /etc/httpd/conf.d/php.conf in your favorite editor and comment out everything. As an alternative you can rename php.conf into php.conf.bak which will prevent apache from loading this config file.
3. Here is my variant of /etc/httpd/conf.d/fcgid.conf – your can customize it as you see fit
   
   Apache

   LoadModule fcgid_module modules/mod_fcgid.so # Use FastCGI to process .fcg .fcgi & .fpl scripts # Don't do this if mod_fastcgi is present, as it will try to do the same thing <IfModule mod_fcgid.c> PHP_Fix_Pathinfo_Enable 1 IPCCommTimeout 180 MaxProcessCount 150 DefaultMaxClassProcessCount 15 DefaultMinClassProcessCount 5 AddType application/x-httpd-php .php AddHandler php-fcgi .php Action php-fcgi /fcgi-bin/php-fcgi FCGIWrapper /var/www/cgi-bin/php-fcgi .php Alias /fcgi-bin/ /var/www/cgi-bin/ <Location /fcgi-bin/> SetHandler fcgid-script Options +ExecCGI </Location> DirectoryIndex index.php # Sane place to put sockets and shared memory file SocketPath run/mod_fcgid SharememPath run/mod_fcgid/fcgid_shm </IfModule>

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

   LoadModule fcgid_module modules/mod_fcgid.so   # Use FastCGI to process .fcg .fcgi & .fpl scripts # Don't do this if mod_fastcgi is present, as it will try to do the same thing <IfModule mod_fcgid.c>     PHP_Fix_Pathinfo_Enable 1     IPCCommTimeout 180     MaxProcessCount 150     DefaultMaxClassProcessCount 15     DefaultMinClassProcessCount 5     AddType application/x-httpd-php .php     AddHandler php-fcgi .php     Action php-fcgi /fcgi-bin/php-fcgi     FCGIWrapper /var/www/cgi-bin/php-fcgi .php     Alias /fcgi-bin/ /var/www/cgi-bin/ <Location /fcgi-bin/>         SetHandler fcgid-script         Options +ExecCGI </Location> DirectoryIndex index.php   # Sane place to put sockets and shared memory file SocketPath run/mod_fcgid SharememPath run/mod_fcgid/fcgid_shm </IfModule>

4. Lets create example virtual host web1.com (manually for now – later on I will explain how to do it automatically with virtualmin). We have system user web1(503) in group web1(503). First we have to create proper fcgi wrapper for php – suExec executes scripts from /var/www/cgi-bin while usually user virtual hosts contents are located in /home.
   
# mkdir -p /var/www/cgi-bin/web1
# cat > /var/www/cgi-bin/web1/php-web1
#!/bin/sh
export PHPRC=/home/web1
export PHP_FCGI_MAX_REQUESTS=5000
export PHP_FCGI_CHILDREN=1
exec /usr/bin/php-cgi
^D
# chmod 755 /var/www/cgi-bin/web1/php-web1
# chown -R web1.web1 /var/www/cgi-bin/web1

   We will also need to create default fcgi wrapper, specified in fcgid.conf.
   
# cat > /var/www/cgi-bin/php-fcgi
#!/bin/sh
export PHPRC=/etc
export PHP_FCGI_MAX_REQUESTS=5000
export PHP_FCGI_CHILDREN=1
exec /usr/bin/php-cgi
^D
# chmod 755 /var/www/cgi-bin/php-fcgi

   This part is finished.
5. Now, apache virtual host config file in /etc/httpd/conf.d/web1.conf
   
   Apache

   <VirtualHost xx.xx.xx.xx:80> ServerName web1.com ServerAlias www.web1.com DocumentRoot /home/web1/public_html ErrorLog /home/web1/logs/error_log CustomLog /home/web1/logs/access_log combined ScriptAlias /cgi-bin/ /home/web1/cgi-bin/ DirectoryIndex index.html index.htm index.php index.php4 index.php5 <IfModule mod_fcgid.c> Alias /fcgi-bin/ /var/www/cgi-bin/ <Location /fcgi-bin/> SetHandler fcgid-script Options +ExecCGI </Location> SuexecUserGroup "#503" "#503" <Directory /home/web1/public_html> Options -Indexes IncludesNOEXEC FollowSymLinks +ExecCGI AddHandler php-fcgi .php Action php-fcgi /fcgi-bin/web1/php-web1 FCGIWrapper /var/www/cgi-bin/web1/php-web1 .php allow from all AllowOverride All </Directory> </IfModule> <Directory /home/web1/cgi-bin> Options ExecCGI Allow from all </Directory> </VirtualHost>

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

   <VirtualHost xx.xx.xx.xx:80> ServerName web1.com ServerAlias www.web1.com DocumentRoot /home/web1/public_html ErrorLog /home/web1/logs/error_log CustomLog /home/web1/logs/access_log combined ScriptAlias /cgi-bin/ /home/web1/cgi-bin/ DirectoryIndex index.html index.htm index.php index.php4 index.php5 <IfModule mod_fcgid.c> Alias /fcgi-bin/ /var/www/cgi-bin/ <Location /fcgi-bin/>    SetHandler fcgid-script    Options +ExecCGI </Location>    SuexecUserGroup "#503" "#503" <Directory /home/web1/public_html> Options -Indexes IncludesNOEXEC FollowSymLinks +ExecCGI    AddHandler php-fcgi .php    Action php-fcgi /fcgi-bin/web1/php-web1    FCGIWrapper /var/www/cgi-bin/web1/php-web1 .php allow from all AllowOverride All </Directory> </IfModule> <Directory /home/web1/cgi-bin> Options ExecCGI Allow from all </Directory> </VirtualHost>

6. Copy php.ini file into /home/web1.
   
# cp /etc/php.ini /home/web1/
# chown web1.web1 /home/web1/php.ini

   Restart apache. In /home/web1/public_html create simple test script and chown it to web1.web1
   
   PHP

   <? echo "I am running as user="; system("whoami"); echo "<P>I can write here= "; system("pwd"); $fname="write_test.txt"; if (file_exists($fname)) { echo "<P> I found file $fname and will delete it"; unlink($fname); echo "...Done"; } echo "<P>I'm writing new file $fname"; system ("touch $fname"); ?>

   1 2 3 4 5 6 7 8 9 10 11 12 13 14

   <? echo "I am running as user="; system("whoami"); echo "<P>I can write here= "; system("pwd"); $fname="write_test.txt"; if (file_exists($fname)) {         echo "<P> I found file $fname and will delete it";         unlink($fname);         echo "...Done";         } echo "<P>I'm writing new file $fname"; system ("touch $fname"); ?>

   
   If you will see this
   
   Shell

   I am running as user=web1 I can write here= /home/web1/public_html I found file write_test.txt and will delete it...Done I'm writing new file write_test.txt

   1 2 3 4 5 6 7

   I am running as user=web1   I can write here= /home/web1/public_html   I found file write_test.txt and will delete it...Done   I'm writing new file write_test.txt

   
   Then virtual host is configured correctly
7. Finishing touches:
   • On CentOS session information is stored in /var/lib/php/session, that is owned by apache.apache. Since suEXEC’ed PHP creates session files owned by user that owns the script, session dir permissions should be adjusted:
     # chown 1777 /var/lib/php/session
   • Since we are not running thread-unsafe mod_php now we can swtich apache to worker MPM:
     
# sed -i '/worker/s/^#//' /etc/sysconfig/httpd
# service httpd restart

   • After switching to PHP FCGI mode, all “php_” options in .htaccess files will result in 500 server error, because without mod_php apache doesn’t understand them. Majority of this configuration options could be done via user php.ini file.
     
# find /home -name .htaccess -exec grep -nH php_ {} \;

   • Switching PHP into CGI/FCGI mode breaks some php scripts that do basic http auth, phpMyAdmin in particular. This could be fixed with the followinng .htaccess file in phpMyAdmin directory
     
     Apache

     RewriteEngine On RewriteRule .* - [E=REMOTE_USER:%{HTTP:Authorization},L]

     1 2	RewriteEngine On RewriteRule .* - [E=REMOTE_USER:%{HTTP:Authorization},L]

8. And last – Virtualmin apache virtual host template.
   
   Apache

   ServerName ${DOM} ServerAlias *.${DOM} DocumentRoot ${HOME}/public_html ErrorLog ${HOME}/logs/error_log CustomLog ${HOME}/logs/access_log combined ScriptAlias /cgi-bin/ ${HOME}/cgi-bin/ <IfModule mod_fcgid.c> Alias /fcgi-bin/ /var/www/cgi-bin/ <Location /fcgi-bin/> SetHandler fcgid-script Options +ExecCGI </Location> DirectoryIndex index.html index.htm index.php index.php4 index.php5 SuexecUserGroup "#${UID}" "#${GID}" <Directory ${HOME}/public_html> Options +ExecCGI -Indexes IncludesNOEXEC FollowSymLinks AllowOverride All AddHandler php-fcgi .php Action php-fcgi /fcgi-bin/${USER}/php-${USER} Order allow,deny Allow from all </Directory> </IfModule> <Directory ${HOME}/cgi-bin> Options ExecCGI Allow from all </Directory>

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

   ServerName ${DOM} ServerAlias *.${DOM} DocumentRoot ${HOME}/public_html ErrorLog ${HOME}/logs/error_log CustomLog ${HOME}/logs/access_log combined ScriptAlias /cgi-bin/ ${HOME}/cgi-bin/   <IfModule mod_fcgid.c> Alias /fcgi-bin/ /var/www/cgi-bin/ <Location /fcgi-bin/>      SetHandler fcgid-script      Options +ExecCGI </Location> DirectoryIndex index.html index.htm index.php index.php4 index.php5     SuexecUserGroup "#${UID}" "#${GID}"      <Directory ${HOME}/public_html>       Options +ExecCGI -Indexes IncludesNOEXEC FollowSymLinks       AllowOverride All       AddHandler php-fcgi .php       Action php-fcgi /fcgi-bin/${USER}/php-${USER}       Order allow,deny       Allow from all     </Directory>   </IfModule> <Directory ${HOME}/cgi-bin> Options ExecCGI Allow from all </Directory>

   
   Note – Suexec option in virtualmin should be disabled.
   Along with this template we need to add post-install custom script that will create fcgi wrapper and copy/chown php.ini into the user homedir.
   
   Shell

   #!/bin/bash cgi_path="/var/www/cgi-bin" # creating php-fcgi wrapper for apache vhosts if [ "$VIRTUALSERVER_ACTION" = "CREATE_DOMAIN" ]; then if [ ! -d ${cgi_path}/${VIRTUALSERVER_USER} ]; then mkdir ${cgi_path}/${VIRTUALSERVER_USER} fi cd ${cgi_path}/${VIRTUALSERVER_USER} cat > php-${VIRTUALSERVER_USER} <<EOP #!/bin/sh export PHPRC=${VIRTUALSERVER_HOME} export PHP_FCGI_MAX_REQUESTS=5000 export PHP_FCGI_CHILDREN=0 exec /usr/bin/php-cgi EOP chmod 755 php-${VIRTUALSERVER_USER} chown ${VIRTUALSERVER_USER}.${VIRTUALSERVER_GROUP} -R . cp /etc/php.ini ${VIRTUALSERVER_HOME}/ chown -R ${VIRTUALSERVER_USER}.${VIRTUALSERVER_GROUP} ${VIRTUALSERVER_HOME} else exit 0 fi

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

   #!/bin/bash   cgi_path="/var/www/cgi-bin" # creating php-fcgi wrapper for apache vhosts if [ "$VIRTUALSERVER_ACTION" = "CREATE_DOMAIN" ]; then           if [ ! -d  ${cgi_path}/${VIRTUALSERVER_USER} ]; then                 mkdir ${cgi_path}/${VIRTUALSERVER_USER}         fi         cd ${cgi_path}/${VIRTUALSERVER_USER}         cat > php-${VIRTUALSERVER_USER} <<EOP #!/bin/sh export PHPRC=${VIRTUALSERVER_HOME} export PHP_FCGI_MAX_REQUESTS=5000 export PHP_FCGI_CHILDREN=0 exec /usr/bin/php-cgi EOP           chmod 755 php-${VIRTUALSERVER_USER}         chown ${VIRTUALSERVER_USER}.${VIRTUALSERVER_GROUP} -R .         cp /etc/php.ini ${VIRTUALSERVER_HOME}/         chown -R ${VIRTUALSERVER_USER}.${VIRTUALSERVER_GROUP} ${VIRTUALSERVER_HOME}       else         exit 0 fi

   
   Copy this script into /usr/local/sbin/ and in Virtualmin add it to “script run after creation of virtual host” settings field.
   Try to create test virtual host and verify that all structure was created properly and has proper permissions /ownership. In case of problems refer to server logs (/var/log/httpd/suexec.log could be very useful).