This post is kind of a sequel to that post….
One big problem with suexec and suphp on Apache imho is that files run as their owner, thus an accidental chown might break things. A more logical thing would be to assign a user/group to each VirtualHost, which is exactly what the ITK MPM does.
On top of that it has some additional handy features, such as limiting the maximum number of concurrent requests per VirtualHost and setting a niceness value so you can define a cpu affinity per virtual host.
Now the dc member server finally has users properly isolated from one another.
Setting up mpm-itk was a lot easier than suphp,suexec,or peruser-mpm. (I tried peruser-mpm first, and apache just segfaulted :S).
With only a few lines of additional configuration, I was easily able to automate the migration of our 100+ accounts with a quick and dirty perl script.
mpm-itk is included in the default apache install on FreeBSD. There is no separate port for it (like there is for peruser). To use it, compile apache like this:
cd /usr/ports/www/apache22
make WITH_MPM=itk
make install
And that’s it. Apache will now use the itk mpm, and you can add the
AssignUserID line to your VirtualHost. Anything running on it will run as the specified user/group, whether it’s plain html, php, or cgi. That’s another advantage, since with suexec you end up configuring each web-scripting language individually, and then risk still not covering everything.
Sounds perfect.. can’t wait to see how well it works in practice.. is this the holy grail or are there areas where this could be bypassed?
You still need proper permissions on the system. The vhosts are not chrooted as they run. But since it’s all running on a jailed apache, and none of the member’s folders are world readable, you pretty much achieve the same effect.
I’m not sure if there is such a thing as a holy grail, but it’s pretty good. :)
how bad is the hit on memory and cpu?
The memory/cpu cost of running it isn’t that much higher of a normal preform mpm really. However there is some performance hit, just because there is an extra fork involved to run the process as the specified user. So while you have some speed loss, you don’t really have that much memory/cpu loss. If that makes sense :)
yeah that makes a lot of sense, and sounds infinitely better than the other options we discussed in the past about having separate processes for every user.
Yep. :)