Notes: Getting suEXEC execution for PHP under Virtualmin GPL

Published on June 4, 2009 in notes and tech. 2 Comments

(On Debian 5.0. May be slightly different on other distros)

Create files in /etc/skel/:

$ cd /etc/skel
$ mkdir -P etc/php5
$ cp /etc/php5/apache2/php.ini /etc/skel/etc/php5/php.ini
$ mkdir fcgi-bin
$ vi fcgi-bin/php5.fcgi

Paste the following:

#!/bin/bash

export PHPRC=$PWD/../etc/php5
umask 022
export SCRIPT_FILENAME=$PATH_TRANSLATED
exec /usr/bin/php-cgi

Then, in Virtualmin > System Settings > Server Templates > Default Settings > Apache website > Directives and settings:

ServerName ${DOM}
ServerAlias www.${DOM}
DocumentRoot ${HOME}/public_html
ErrorLog /var/log/virtualmin/${DOM}_error_log
CustomLog /var/log/virtualmin/${DOM}_access_log combined
DirectoryIndex index.html index.htm index.php index.php4 index.php5

Options -Indexes IncludesNOEXEC FollowSymLinks ExecCGI
allow from all
AllowOverride All

AddHandler fcgid-script .php
FCGIWrapper ${HOME}/fcgi-bin/php5.fcgi .php

AddHandler cgi-script cgi

Important notes:

  • ExecCGI is required! Otherwise, 403 Forbidden errors will occur.
  • The wrapper script and php files must not be group/world-writable!
  • Look in /var/log/apache2/suexec.log for hints if you’re having trouble.

2 Responses to “Notes: Getting suEXEC execution for PHP under Virtualmin GPL”

Feed for this Entry Trackback Address
  • Moritz von Schweinitz
    February 23, 2010 at 17:55

    Hi!

    Just wanted to let you know that:
    a) I think your wordpress ate a part of the apache config you have there (everything between greater-than and lesser-than tags)
    b) maybe you’d like to point out the (obvious) prerequisites of having to install libapache2-mod-fcgid and php5-cgi
    c) this isn’t working for me – i only get 404 everywhere i go. and my /var/log/apache2/error_log says: “script ‘/var/www/php.php’ not found or unable to stat”, but i have NO idea where the ‘/var/www’ is coming from.

  • David
    February 23, 2010 at 18:23

    Hi Moritz:

    a. I didn’t include anything between <> tags.. that’s just the partial bit of the config file that’s visible from that section of Virtualmin. If you edit the config file manually, of course, you’ll have to find the right place to put it.

    b and c. Yes — in fact, another prerequisite is to have installed the Virtualmin packages for Apache, or have a custom build that changes the docroot (Search the manual for “docroot”). The default version of suEXEC only executes things under /var/www for security purposes. Do you see anything in the suexec log file?

Leave a Reply