typo3 mit ispconfig3 / suexec

[bn61]

Hi,
I have setup an apache (SUExec/fcgi) with the help of ISPConfig3.
In order to find a suitable solution I started off with the typo3 sources within the webserver directory.
When I try calling the typo3 backend I get the following error:

Warning: fopen() [function.fopen]: open_basedir restriction in effect.
File(/var/www/BLABLA/web/typo3temp/llxml/misc.xml_f45d73fa32.de.iso-8859-1.cache)
is not within the allowed path(s):
(/var/www/BLABLA/:/var/www/clients/client2/web2/)
in /var/www/clients/client2/web2/web/t3lib/class.t3lib_div.php  on line 2752

Warning:
fopen(/var/www/BLABLA/web/typo3temp/llxml/misc.xml_f45d73fa32.de.iso-8859-1.cache)
[function.fopen]: failed to open stream: 
Operation not permitted in /var/www/clients/client2/web2/web/t3lib/class.t3lib_div.php on line 2752

ERROR: File not written to disk! Write permission error in filesystem?

Clearly this error message contradicts itself since the file in question is in the directory that is defined in the open_basedir statement.
Any ideas?

[till]

Are all files and folders owned by the user and group of the website?

[bn61]

Yes, every single one.

[bn61]

/etc/apache2/sites-available/BLABLA.vhost:

<Directory /var/www/BLABLA>
    AllowOverride None
    Order Deny,Allow
    Deny from all
</Directory>

<VirtualHost *:80>
      DocumentRoot /var/www/BLABLA/web

    ServerName BLABLA
    ServerAdmin webmaster@BLABLA

    ErrorLog /var/log/ispconfig/httpd/BLABLA/error.log

    ErrorDocument 400 /error/400.html
    ErrorDocument 401 /error/401.html
    ErrorDocument 403 /error/403.html
    ErrorDocument 404 /error/404.html
    ErrorDocument 405 /error/405.html
    ErrorDocument 500 /error/500.html
    ErrorDocument 503 /error/503.html

    <Directory /var/www/BLABLA/web>
        Options FollowSymLinks
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>
    <Directory /var/www/clients/client2/web2/web>
        Options FollowSymLinks
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>

    # cgi enabled
        <Directory /var/www/clients/client2/web2/cgi-bin>
      Order allow,deny
      Allow from all
    </Directory>
    ScriptAlias  /cgi-bin/ /var/www/clients/client2/web2/cgi-bin/
    AddHandler cgi-script .cgi
    AddHandler cgi-script .pl
    # suexec enabled
    SuexecUserGroup web2 client2
    # php as fast-cgi enabled
    <Directory /var/www/BLABLA/web>
        AddHandler fcgid-script .php .php3 .php4 .php5
        FCGIWrapper /var/www/php-fcgi-scripts/web2/.php-fcgi-starter .php
        Options +ExecCGI
        AllowOverride all
        Order allow,deny
        Allow from all
    </Directory>
</VirtualHost>

/var/www/php-fcgi-scripts/web2/.php-fcgi-starter

#!/bin/sh
PHPRC="/etc/php5/cgi/"
export PHPRC
PHP_DOCUMENT_ROOT="/var/www/clients/client2/web2"
export PHP_DOCUMENT_ROOT
# The variable PHP_FCGI_CHILDREN is onyl useful for lighty or nginx as apache
# mod_fcgi will control the number of childs themself and never use the additional processes.
# PHP_FCGI_CHILDREN=8
# export PHP_FCGI_CHILDREN
PHP_FCGI_MAX_REQUESTS=5000
export PHP_FCGI_MAX_REQUESTS
exec /usr/bin/php-cgi \
 -d open_basedir=/var/www/BLABLA/:/var/www/clients/client2/web2/ \
-d upload_tmp_dir=/var/www/clients/client2/web2/tmp \
-d session.save_path=/var/www/clients/client2/web2/tmp \
-d memory_limit="64M" \
-d IPCCommTimeout=60 \
 $1

(the green parts are manually changed by me)

server:/var/www/clients/client2/web2/web# ls -l
total 368
drwxr-xr-x  2 web2 client0    111 2010-02-26 18:44 error
drwxr-xr-x  7 web2 client0   4096 2010-03-03 22:22 fileadmin
-rw-r--r--  1 web2 client0  18348 2008-01-29 11:27 GPL.txt
-rw-r--r--  1 web2 client0     13 2008-02-08 11:01 index.htm
-rw-r--r--  1 web2 client0   2903 2008-01-29 11:27 index.php
drwxr-xr-x  3 web2 client0   4096 2010-03-02 18:32 misc
-rwxr-xr--  1 web2 client0     34 2010-02-26 18:44 robots.txt
drwxr-xr-x  2 web2 client0   4096 2010-03-03 00:30 stats
drwxr-xr-x  7 web2 client0   4096 2010-03-03 19:06 t3lib
drwxr-xr-x 13 web2 client0   4096 2010-03-03 11:21 typo3
drwxrwxrwx  5 web2 client0   4096 2010-03-03 22:22 typo3conf
drwxrwxrwx 11 web2 client0  20480 2010-03-03 22:22 typo3temp
drwxr-xr-x 14 web2 client0   4096 2010-03-03 22:22 uploads

[till]

The permissions do not look right. It seems as if you moved the site to another client without changing the owner of the files. Please post the output of:

ls -la /var/www/clients/client2/web2/web

[bn61]

yes, I just saw that the group rights were not correct and changed them to client2. unfortunately that gave me the same results.

anyway here is the results of ls -la /var/www/clients/client2/web2/web

-rw-r--r--  1 web2 client2 215227 2008-01-29 11:27 ChangeLog
-rw-r--r--  1 web2 client2   4690 2008-03-07 17:08 dmailerd.php
drwxr-xr-x  2 web2 client2    111 2010-02-26 18:44 error
drwxr-xr-x  7 web2 client2   4096 2010-03-03 22:22 fileadmin
-rw-r--r--  1 web2 client2  18348 2008-01-29 11:27 GPL.txt
-rw-r--r--  1 web2 client2    535 2010-03-03 14:30 .htaccess
-rw-r--r--  1 web2 client2     13 2008-02-08 11:01 index.htm
-rw-r--r--  1 web2 client2   2903 2008-01-29 11:27 index.php
drwxr-xr-x  3 web2 client2   4096 2010-03-02 18:32 misc
-rwxr-xr--  1 web2 client2     34 2010-02-26 18:44 robots.txt
drwxr-xr-x  2 web2 client2   4096 2010-03-03 00:30 stats
drwxr-xr-x  7 web2 client2   4096 2010-03-03 19:06 t3lib
drwxr-xr-x 13 web2 client2   4096 2010-03-03 11:21 typo3
drwxrwxrwx  5 web2 client2   4096 2010-03-03 22:22 typo3conf
drwxrwxrwx 11 web2 client2  20480 2010-03-03 22:22 typo3temp
drwxr-xr-x 14 web2 client2   4096 2010-03-03 22:22 uploads

[bn61]

I took a look at my suexec.log:

[2010-03-04 19:33:10]: uid: (5005/web4) gid: (5008/5008) cmd: .php-fcgi-starter

The thing that caught my eye is the "mismatch" of the uid. (5005 and web4 are the same user)
Could that be the problem? And if so, where does it stem from?

[till]

The log line looks fine. You should install a phpinfo file and check the open basedir setting with it.

[bn61]

The open_basedir entry in the phpinfo shows exactly what it is supposed to:

/var/www/BLABLA:/var/www/clients/client4/web4

(Don't worry about "client4/web4". I have setup a new webs, just to be on the safe side.)

[till]

Do you use the symlinked setup in typo3? In this case it might be that some symlinks are wrong. I have several typo3 installs on my server and never had a problem with installing them, but I always use the setup without symlinks.