fastcgi and php with ispconfig

[tosser]

Howtos about fastcgi and php that are used or consulted:
http://www.debianhowto.de/de/howtos/...ache2_php-fcgi
http://www.syscp.de/wiki/contrib/PHP-FCGI-ger




Apache2 Install
In the first step you install apache2-mpm-worker

apt-get install apache2-common apache2-mpm-worker apache2-threaded-dev

restart the apache, but without mod_php. mod_php runs not with apache2-mpm-worker! If you want to use mod_php and fastcgi then you need apache2-mpm-prefork!

/etc/init.d/apache2 restart

Build Suexec
then you load the apache sources to compile a new suexec for fastcgi

cd /root
apt-get source apache2-common
cd apache2-2.0.54
cd upstream
cd tarballs
tar zxf httpd-2.0.51.tar.gz
cd httpd-2.0.54
cd support
vi suexec.h

edit the follow lines:

#define AP_HTTPD_USER "www"

with

#define AP_HTTPD_USER "www-data"

#define AP_LOG_EXEC DEFAULT_EXP_LOGFILEDIR "/suexec_log" /* Need me? */

with

#define AP_LOG_EXEC "/var/log/apache2/suexec.log" /* Need me? */

#define AP_DOC_ROOT DEFAULT_EXP_HTDOCSDIR

with

#define AP_DOC_ROOT "/var/www"

edit suexec.c

vi suexec.c

then insert the red market text into

  /* no file owner check
    if ((uid != dir_info.st_uid) ||
        (gid != dir_info.st_gid) ||
 
 
        (uid != prg_info.st_uid) ||
        (gid != prg_info.st_gid)) {
        log_err("target uid/gid (%ld/%ld) mismatch "
                "with directory (%ld/%ld) or program (%ld/%ld)\n",
                uid, gid,
                dir_info.st_uid, dir_info.st_gid,
                prg_info.st_uid, prg_info.st_gid);
        exit(120);
    }
  */

You need the apache2-header-files to compile suexec

cp -p /usr/include/apache2/* .
cp -p /usr/include/apr-0/* .

make suexec

then you must have:

ls -l suexec
-rwxr-xr-x  1 root root 20565 Aug  5 23:37 suexec

copy the suexec for fcgi to /usr/lib/apache2

cp suexec /usr/lib/apache2/suexec-fcgi
chmod 4755 /usr/lib/apache2/suexec-fcgi

you can delete the files, that you has downloaded with apt-source



Compile PHP (next step you can install by debian packages without compiling)

$ cd
mkdir php5
cd php5
wget http://de3.php.net/get/php-5.1.4.tar.gz/from/a/mirror
tar zxf php-5.1.4.tar.gz
cd php-5.1.4.tar.gz

./configure --enable-memory-limit --enable-force-cgi-redirect  \
--enable-track-vars --with-pcre-regex --with-mysql --without-sqlite \
--without-mm --enable-fastcgi --prefix=/home/_USER_/php5
make
make install

Important for php5 compilation and fastcgi:

apt-get install libmysqlclient14-dev libxml2-dev

./configure with: –enable-fastcgi –without-mm

if any packages missed use

apt-cache search "MISSED"
apt-get install "THE NEEDED PACKAGE

Inofficial Debain Packages for PHP5:

echo "deb http://people.debian.org/~dexter php5.1 sarge" >> /etc/apt/sources.list
echo "deb-src http://people.debian.org/~dexter php5.1 sarge" >> /etc/apt/sources.list
apt-get update
apt-get install php5.0 php5.0-common php5.0-fcgi apache2-mpm-worker

apt-get install apache2-mpm-worker because debian would like to remove it and install apache2-mpm-prefork again.



libapache2-mod-fastgi:
you musst edit the "/etc/apt/source.list" and include the non-free sector. It show like that:

deb http://ftp.de.debian.org/debian/ stable main non-free

then

apt-get update
apt-get install libapache2-mod-fastcgi

then you edit the "/etc/apache2/mods-avaible/fastcgi.conf" with you favorit editor

vi /etc/apache2/mods-available/fastcgi.conf

it musst show like:

<IfModule mod_fastcgi.c>

#temporary sockets are stored here, this must be at the top!
FastCgiIpcDir /var/lib/apache2/fastcgi

#config
FastCgiConfig -pass-header Authorization


FastCgiWrapper /usr/lib/apache2/suexec-fcgi


AddHandler php-fastcgi .php
<Location /php/.php-fcgi-starter>
SetHandler fastcgi-script
Options +ExecCGI
</Location>
Action php-fastcgi /php/.php-fcgi-starter

##ISPConfig add this by the installtion of it

##ISPConfig INSTALL## AddType ##ISPConfig INSTALL## application/x-httpd-php .php

<Directory "/var/www/">
AllowOverride None
Options +ExecCGI -MultiViews -Indexes
Order allow,deny
Allow from all
</Directory>
</IfModule>

-------------------------------------------------------------------------
now you must install ispconfig, if you didn't have it or you modify it by own
-------------------------------------------------------------------------


fast-cgi start script
You need a fast-cgi starter for all web hosts:

cd /root/ispconfig/scripts
vi php-fcgi-starter

my php-fcgi-starter (with apache php5.1-fcgi package):

#!/bin/sh
PHPRC="/etc/php5.1/fcgi/"
export PHPRC
PHP_FCGI_CHILDREN=4
export PHP_FCGI_CHILDREN
exec /usr/bin/php5.1-fcgi

it must have root permissions:

chmod 755 php-fcgi-starter
chown root:root php-fcgi-starter

-rwxr-xr-x 1 root root 151 2006-05-31 00:15 php-fcgi-starter

that the webuser can excute it (by suexec) but can't edit it!


-------------------------------------------------------------------------------------------------------
ispconfig copy this to /var/www/web*/ if you activate php for this web, but you must modify ispconfig:
-------------------------------------------------------------------------------------------------------


modify ISPConfig
you must patch the config.lib.php

cd /root/ispconfig/scripts/lib

then you must patch config.lib.php with the patch file in the attachemend.
Copy the patch file into /root/ispconfig/scripts/lib.

patch config.lib.php < fcgi_patch.txt

By the first php activate for a web Account, it will be create a .php-fcgi-starter for this user. If you wish to modify php for this user, then you must create a new php.ini for this user or change it for all. And edit the fast-cgi-starter script for this user.
php_admin_flag in the apache config didn't run and the php_sage_mod button in ispconfig didn't act after the patch/ with fastcgi!

I'm pleased to get feedback and better solutions
and I hope that fastcgi find a way into the default installation of ispconfig

[falko]

Thanks for the nice walkthrough! I've copied it also to the Tips/trickd forum.

[tosser]

I have update the howto, with a better solution.
so you can can activate or disable it with the php button.

[tom]

@tosser

1: Why you build a new suexec binary does'nt it work even whith the usual suexec installation?

In that german tutorial http://archiv.debianhowto.de/de/apac...suexec_install it tells the need to build an own suexec binary only if somebody does'nt have a filesysthem whitout the possibility to set the immutable-bit.

2. How are you define the FastCgiServer for different vhosts?

[tosser]

Hi!
I build a new suexec, because it is easier to add a new web account in ispconfig. and it make it easier to edit the script as root.
but you can also set the immutable-bit in /root/ispconfig/scripts/lib/config.lib.php. then ISPC. set it automatically after copy the php-fcgi-starter into the user folder.

all web accounts with php have a .php-fcgi-starter script. there can you set some paramaters for fcgi/php (like a php.ini).
in the vhost for this webs ispconfig create a ScriptAlias to the startscript.
like this:

ScriptAlias /php/ /var/www/web1/

and in the fastcgi config define the php start script with this parameter:

Action php-fastcgi /php/.php-fcgi-starter

so you start a fcgi-server for the different vhosts.

for example:
fastcgi start it for web1 in /var/www/web1/.php-fcgi-starter
and web2 in /var/www/web2/.php-fcgi-starter

[tom]

It is great an more secure to use php-fcgi rather than the usual php. That's the reason why I want to use fcgi. I dont realy understand how to use and define
the "FastCgiServer" for different vhosts (That's me second question) because php-fcgi is still working without a defined "FastCgiServer"?

[tosser]

The FastCGIServer is php-fcgi.
you define it dynamic for all vhosts. with execute php-fcgi in the php-starter-script and not with a static parameter in the fastcgi.conf!

[tom]

Originally Posted by tosser

The FastCGIServer is php-fcgi.
you define it dynamic for all vhosts. with execute php-fcgi in the php-starter-script and not with a static parameter in the fastcgi.conf!

ok, thanks! The diffenrent is between static and dynamic, aha:-)
So I had defined a static FastCGIServer and a dynamic one?

I created the fastcgi.conf like:

<IfModule mod_fastcgi.c>
 FastCgiIpcDir /var/lib/apache2/fastcgi
  AddHandler fastcgi-script .fcgi

  FastCgiWrapper /usr/lib/apache2/suexec2
  FastCgiServer /var/www/php-fcgi-scripts/web1/php-fcgi-starter -user web1_admin -group web1
 FastCgiServer /var/www/php-fcgi-scripts/web2/php-fcgi-starter -user web2_admin -group web2

   AddHandler php-fastcgi .php

<Location /cgi-bin/php-fcgi-starter>
        SetHandler fastcgi-script
        Options +ExecCGI
</Location>

Action php-fastcgi /cgi-bin/php-fcgi-starter

AddType application/x-httpd-php .php
</IfModule>

and the starter script like:

#!/bin/sh
PHPRC="/var/www/php-fcgi-scripts/web1"
export PHPRC
PHP_FCGI_CHILDREN=4
export PHP_FCGI_CHILDREN
exec /var/www/php-fcgi-scripts/php5-fcgi-hard/bin/php

and for the vhosts (include in isp httpd.conf options field):

ScriptAlias /cgi-bin/ /var/www/php-fcgi-scripts/web1/
<Directory '/var/www/php-fcgi-scripts/web1'>
AllowOverride None
Options +ExecCGI -MultiViews -Indexes
Order allow,deny
Allow from all
</Directory>

You mean this

  FastCgiServer /var/www/php-fcgi-scripts/web1/php-fcgi-starter -user web1_admin -group web1
 FastCgiServer /var/www/php-fcgi-scripts/web2/php-fcgi-starter -user web2_admin -group web2

I have to take off because it's I've already defined the FastCgiServer dynamicly by
PHPRC="/var/www/php-fcgi-scripts/web1", right?

[tosser]

No
PHPRC define the path to configurations like php.ini
FastCgiServer is for an static starter and you can't define two FastCgiServer!

for your vhosts with a own start script you need no fastcgiserver paramter in you config. you can define one fastcgiserver but you mustn't du that.

please read http://www.fastcgi.com/docs/faq.html#PHP, there are a general howto for fastcgi with php

does you use ispconfig for manage your vhosts etc.?

[tom]

Originally Posted by tosser

No
PHPRC define the path to configurations like php.ini

Yes, I no...

Originally Posted by tosser

does you use ispconfig for manage your vhosts etc.?

Yes, I use this entries in the ISPConifg Vhosts:
ScriptAlias /cgi-bin/ /var/www/php-fcgi-scripts/web1/

<Directory '/var/www/php-fcgi-scripts/web1'>
AllowOverride None
Options +ExecCGI -MultiViews -Indexes
Order allow,deny
Allow from all
</Directory>

and it works fine.

Thanks for the hint of the needless FastCgiServer.

I think this entry is ok for get the right permissions for the fcgi-user in the vhosts. It is defined in
/etc/apache2/mods-enabled/fastcgi.conf

FastCgiWrapper /usr/lib/apache2/suexec2

And I think I only need to define it once there and no more in any vhost separate,right?