github.com/krum110487/go-htaccess@v0.0.0-20240316004156-60641c8e7598/tests/data/apache_2_2_34/manual/suexec.html.en (about) 1 <?xml version="1.0" encoding="ISO-8859-1"?> 2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> 3 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head> 4 <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" /> 5 <!-- 6 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 7 This file is generated from xml source: DO NOT EDIT 8 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 9 --> 10 <title>suEXEC Support - Apache HTTP Server Version 2.2</title> 11 <link href="./style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" /> 12 <link href="./style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" /> 13 <link href="./style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="./style/css/prettify.css" /> 14 <script src="./style/scripts/prettify.min.js" type="text/javascript"> 15 </script> 16 17 <link href="./images/favicon.ico" rel="shortcut icon" /><link href="http://httpd.apache.org/docs/current/suexec.html" rel="canonical" /></head> 18 <body id="manual-page"><div id="page-header"> 19 <p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossary</a> | <a href="./sitemap.html">Sitemap</a></p> 20 <p class="apache">Apache HTTP Server Version 2.2</p> 21 <img alt="" src="./images/feather.gif" /></div> 22 <div class="up"><a href="./"><img title="<-" alt="<-" src="./images/left.gif" /></a></div> 23 <div id="path"> 24 <a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="./">Version 2.2</a></div><div id="page-content"><div class="retired"><h4>Please note</h4> 25 <p> This document refers to a legacy release (<strong>2.2</strong>) of Apache httpd. The active release (<strong>2.4</strong>) is documented <a href="http://httpd.apache.org/docs/current">here</a>. If you have not already upgraded, please follow <a href="http://httpd.apache.org/docs/current/upgrading.html">this link</a> for more information.</p> 26 <p>You may follow <a href="http://httpd.apache.org/docs/current/suexec.html">this link</a> to go to the current version of this document.</p></div><div id="preamble"><h1>suEXEC Support</h1> 27 <div class="toplang"> 28 <p><span>Available Languages: </span><a href="./en/suexec.html" title="English"> en </a> | 29 <a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Français"> fr </a> | 30 <a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> | 31 <a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean"> ko </a> | 32 <a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="Türkçe"> tr </a></p> 33 </div> 34 35 <p>The <strong>suEXEC</strong> feature provides 36 Apache users the ability 37 to run <strong>CGI</strong> and <strong>SSI</strong> programs 38 under user IDs different from the user ID of the calling 39 web server. Normally, when a CGI or SSI program executes, it 40 runs as the same user who is running the web server.</p> 41 42 <p>Used properly, this feature can reduce 43 considerably the security risks involved with allowing users to 44 develop and run private CGI or SSI programs. However, if suEXEC 45 is improperly configured, it can cause any number of problems 46 and possibly create new holes in your computer's security. If 47 you aren't familiar with managing <em>setuid root</em> programs 48 and the security issues they present, we highly recommend that 49 you not consider using suEXEC.</p> 50 </div> 51 <div id="quickview"><ul id="toc"><li><img alt="" src="./images/down.gif" /> <a href="#before">Before we begin</a></li> 52 <li><img alt="" src="./images/down.gif" /> <a href="#model">suEXEC Security Model</a></li> 53 <li><img alt="" src="./images/down.gif" /> <a href="#install">Configuring & Installing 54 suEXEC</a></li> 55 <li><img alt="" src="./images/down.gif" /> <a href="#enable">Enabling & Disabling 56 suEXEC</a></li> 57 <li><img alt="" src="./images/down.gif" /> <a href="#usage">Using suEXEC</a></li> 58 <li><img alt="" src="./images/down.gif" /> <a href="#debug">Debugging suEXEC</a></li> 59 <li><img alt="" src="./images/down.gif" /> <a href="#jabberwock">Beware the Jabberwock: 60 Warnings & Examples</a></li> 61 </ul><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div> 62 <div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div> 63 <div class="section"> 64 <h2><a name="before" id="before">Before we begin</a></h2> 65 66 <p>Before jumping head-first into this document, 67 you should be aware of the assumptions made on the part of the 68 Apache Group and this document.</p> 69 70 <p>First, it is assumed that you are using a UNIX 71 derivative operating system that is capable of 72 <strong>setuid</strong> and <strong>setgid</strong> operations. 73 All command examples are given in this regard. Other platforms, 74 if they are capable of supporting suEXEC, may differ in their 75 configuration.</p> 76 77 <p>Second, it is assumed you are familiar with 78 some basic concepts of your computer's security and its 79 administration. This involves an understanding of 80 <strong>setuid/setgid</strong> operations and the various 81 effects they may have on your system and its level of 82 security.</p> 83 84 <p>Third, it is assumed that you are using an 85 <strong>unmodified</strong> version of suEXEC code. All code 86 for suEXEC has been carefully scrutinized and tested by the 87 developers as well as numerous beta testers. Every precaution 88 has been taken to ensure a simple yet solidly safe base of 89 code. Altering this code can cause unexpected problems and new 90 security risks. It is <strong>highly</strong> recommended you 91 not alter the suEXEC code unless you are well versed in the 92 particulars of security programming and are willing to share 93 your work with the Apache Group for consideration.</p> 94 95 <p>Fourth, and last, it has been the decision of 96 the Apache Group to <strong>NOT</strong> make suEXEC part of 97 the default installation of Apache. To this end, suEXEC 98 configuration requires of the administrator careful attention 99 to details. After due consideration has been given to the 100 various settings for suEXEC, the administrator may install 101 suEXEC through normal installation methods. The values for 102 these settings need to be carefully determined and specified by 103 the administrator to properly maintain system security during 104 the use of suEXEC functionality. It is through this detailed 105 process that the Apache Group hopes to limit suEXEC 106 installation only to those who are careful and determined 107 enough to use it.</p> 108 109 <p>Still with us? Yes? Good. Let's move on!</p> 110 </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div> 111 <div class="section"> 112 <h2><a name="model" id="model">suEXEC Security Model</a></h2> 113 114 <p>Before we begin configuring and installing 115 suEXEC, we will first discuss the security model you are about 116 to implement. By doing so, you may better understand what 117 exactly is going on inside suEXEC and what precautions are 118 taken to ensure your system's security.</p> 119 120 <p><strong>suEXEC</strong> is based on a setuid 121 "wrapper" program that is called by the main Apache web server. 122 This wrapper is called when an HTTP request is made for a CGI 123 or SSI program that the administrator has designated to run as 124 a userid other than that of the main server. When such a 125 request is made, Apache provides the suEXEC wrapper with the 126 program's name and the user and group IDs under which the 127 program is to execute.</p> 128 129 <p>The wrapper then employs the following process 130 to determine success or failure -- if any one of these 131 conditions fail, the program logs the failure and exits with an 132 error, otherwise it will continue:</p> 133 134 <ol> 135 <li> 136 <strong>Is the user executing this wrapper a valid user of 137 this system?</strong> 138 139 <p class="indent"> 140 This is to ensure that the user executing the wrapper is 141 truly a user of the system. 142 </p> 143 </li> 144 145 <li> 146 <strong>Was the wrapper called with the proper number of 147 arguments?</strong> 148 149 <p class="indent"> 150 The wrapper will only execute if it is given the proper 151 number of arguments. The proper argument format is known 152 to the Apache web server. If the wrapper is not receiving 153 the proper number of arguments, it is either being 154 hacked, or there is something wrong with the suEXEC 155 portion of your Apache binary. 156 </p> 157 </li> 158 159 <li> 160 <strong>Is this valid user allowed to run the 161 wrapper?</strong> 162 163 <p class="indent"> 164 Is this user the user allowed to run this wrapper? Only 165 one user (the Apache user) is allowed to execute this 166 program. 167 </p> 168 </li> 169 170 <li> 171 <strong>Does the target CGI or SSI program have an unsafe 172 hierarchical reference?</strong> 173 174 <p class="indent"> 175 Does the target CGI or SSI program's path contain a leading 176 '/' or have a '..' backreference? These are not allowed; the 177 target CGI/SSI program must reside within suEXEC's document 178 root (see <code>--with-suexec-docroot=<em>DIR</em></code> 179 below). 180 </p> 181 </li> 182 183 <li> 184 <strong>Is the target user name valid?</strong> 185 186 <p class="indent"> 187 Does the target user exist? 188 </p> 189 </li> 190 191 <li> 192 <strong>Is the target group name valid?</strong> 193 194 <p class="indent"> 195 Does the target group exist? 196 </p> 197 </li> 198 199 <li> 200 <strong>Is the target user <em>NOT</em> superuser?</strong> 201 202 203 <p class="indent"> 204 suEXEC does not allow <code><em>root</em></code> 205 to execute CGI/SSI programs. 206 </p> 207 </li> 208 209 <li> 210 <strong>Is the target userid <em>ABOVE</em> the minimum ID 211 number?</strong> 212 213 <p class="indent"> 214 The minimum user ID number is specified during 215 configuration. This allows you to set the lowest possible 216 userid that will be allowed to execute CGI/SSI programs. 217 This is useful to block out "system" accounts. 218 </p> 219 </li> 220 221 <li> 222 <strong>Is the target group <em>NOT</em> the superuser 223 group?</strong> 224 225 <p class="indent"> 226 Presently, suEXEC does not allow the <code><em>root</em></code> 227 group to execute CGI/SSI programs. 228 </p> 229 </li> 230 231 <li> 232 <strong>Is the target groupid <em>ABOVE</em> the minimum ID 233 number?</strong> 234 235 <p class="indent"> 236 The minimum group ID number is specified during 237 configuration. This allows you to set the lowest possible 238 groupid that will be allowed to execute CGI/SSI programs. 239 This is useful to block out "system" groups. 240 </p> 241 </li> 242 243 <li> 244 <strong>Can the wrapper successfully become the target user 245 and group?</strong> 246 247 <p class="indent"> 248 Here is where the program becomes the target user and 249 group via setuid and setgid calls. The group access list 250 is also initialized with all of the groups of which the 251 user is a member. 252 </p> 253 </li> 254 255 <li> 256 <strong>Can we change directory to the one in which the target 257 CGI/SSI program resides?</strong> 258 259 <p class="indent"> 260 If it doesn't exist, it can't very well contain files. If we 261 can't change directory to it, it might aswell not exist. 262 </p> 263 </li> 264 265 <li> 266 <strong>Is the directory within the Apache 267 webspace?</strong> 268 269 <p class="indent"> 270 If the request is for a regular portion of the server, is 271 the requested directory within suEXEC's document root? If 272 the request is for a <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>, is the requested directory 273 within the directory configured as suEXEC's userdir (see 274 <a href="#install">suEXEC's configuration options</a>)? 275 </p> 276 </li> 277 278 <li> 279 <strong>Is the directory <em>NOT</em> writable by anyone 280 else?</strong> 281 282 <p class="indent"> 283 We don't want to open up the directory to others; only 284 the owner user may be able to alter this directories 285 contents. 286 </p> 287 </li> 288 289 <li> 290 <strong>Does the target CGI/SSI program exist?</strong> 291 292 <p class="indent"> 293 If it doesn't exists, it can't very well be executed. 294 </p> 295 </li> 296 297 <li> 298 <strong>Is the target CGI/SSI program <em>NOT</em> writable 299 by anyone else?</strong> 300 301 <p class="indent"> 302 We don't want to give anyone other than the owner the 303 ability to change the CGI/SSI program. 304 </p> 305 </li> 306 307 <li> 308 <strong>Is the target CGI/SSI program <em>NOT</em> setuid or 309 setgid?</strong> 310 311 <p class="indent"> 312 We do not want to execute programs that will then change 313 our UID/GID again. 314 </p> 315 </li> 316 317 <li> 318 <strong>Is the target user/group the same as the program's 319 user/group?</strong> 320 321 <p class="indent"> 322 Is the user the owner of the file? 323 </p> 324 </li> 325 326 <li> 327 <strong>Can we successfully clean the process environment 328 to ensure safe operations?</strong> 329 330 <p class="indent"> 331 suEXEC cleans the process' environment by establishing a 332 safe execution PATH (defined during configuration), as 333 well as only passing through those variables whose names 334 are listed in the safe environment list (also created 335 during configuration). 336 </p> 337 </li> 338 339 <li> 340 <strong>Can we successfully become the target CGI/SSI program 341 and execute?</strong> 342 343 <p class="indent"> 344 Here is where suEXEC ends and the target CGI/SSI program begins. 345 </p> 346 </li> 347 </ol> 348 349 <p>This is the standard operation of the 350 suEXEC wrapper's security model. It is somewhat stringent and 351 can impose new limitations and guidelines for CGI/SSI design, 352 but it was developed carefully step-by-step with security in 353 mind.</p> 354 355 <p>For more information as to how this security 356 model can limit your possibilities in regards to server 357 configuration, as well as what security risks can be avoided 358 with a proper suEXEC setup, see the <a href="#jabberwock">"Beware the Jabberwock"</a> section of this 359 document.</p> 360 </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div> 361 <div class="section"> 362 <h2><a name="install" id="install">Configuring & Installing 363 suEXEC</a></h2> 364 365 <p>Here's where we begin the fun.</p> 366 367 <p><strong>suEXEC configuration 368 options</strong><br /> 369 </p> 370 371 <dl> 372 <dt><code>--enable-suexec</code></dt> 373 374 <dd>This option enables the suEXEC feature which is never 375 installed or activated by default. At least one 376 <code>--with-suexec-xxxxx</code> option has to be provided 377 together with the <code>--enable-suexec</code> option to let 378 APACI accept your request for using the suEXEC feature.</dd> 379 380 <dt><code>--with-suexec-bin=<em>PATH</em></code></dt> 381 382 <dd>The path to the <code>suexec</code> binary must be hard-coded 383 in the server for security reasons. Use this option to override 384 the default path. <em>e.g.</em> 385 <code>--with-suexec-bin=/usr/sbin/suexec</code></dd> 386 387 <dt><code>--with-suexec-caller=<em>UID</em></code></dt> 388 389 <dd>The <a href="mod/mpm_common.html#user">username</a> under which 390 Apache normally runs. This is the only user allowed to 391 execute this program.</dd> 392 393 <dt><code>--with-suexec-userdir=<em>DIR</em></code></dt> 394 395 <dd>Define to be the subdirectory under users' home 396 directories where suEXEC access should be allowed. All 397 executables under this directory will be executable by suEXEC 398 as the user so they should be "safe" programs. If you are 399 using a "simple" <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code> 400 directive (ie. one without a "*" in it) this should be set to the same 401 value. suEXEC will not work properly in cases where the <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code> directive points to 402 a location that is not the same as the user's home directory 403 as referenced in the <code>passwd</code> file. Default value is 404 "<code>public_html</code>".<br /> 405 If you have virtual hosts with a different <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code> for each, 406 you will need to define them to all reside in one parent 407 directory; then name that parent directory here. <strong>If 408 this is not defined properly, "~userdir" cgi requests will 409 not work!</strong></dd> 410 411 <dt><code>--with-suexec-docroot=<em>DIR</em></code></dt> 412 413 <dd>Define as the DocumentRoot set for Apache. This will be 414 the only hierarchy (aside from <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>s) that can be used for suEXEC behavior. The 415 default directory is the <code>--datadir</code> value with the suffix 416 "<code>/htdocs</code>", <em>e.g.</em> if you configure with 417 "<code>--datadir=/home/apache</code>" the directory 418 "<code>/home/apache/htdocs</code>" is used as document root for the 419 suEXEC wrapper.</dd> 420 421 <dt><code>--with-suexec-uidmin=<em>UID</em></code></dt> 422 423 <dd>Define this as the lowest UID allowed to be a target user 424 for suEXEC. For most systems, 500 or 100 is common. Default 425 value is 100.</dd> 426 427 <dt><code>--with-suexec-gidmin=<em>GID</em></code></dt> 428 429 <dd>Define this as the lowest GID allowed to be a target 430 group for suEXEC. For most systems, 100 is common and 431 therefore used as default value.</dd> 432 433 <dt><code>--with-suexec-logfile=<em>FILE</em></code></dt> 434 435 <dd>This defines the filename to which all suEXEC 436 transactions and errors are logged (useful for auditing and 437 debugging purposes). By default the logfile is named 438 "<code>suexec_log</code>" and located in your standard logfile 439 directory (<code>--logfiledir</code>).</dd> 440 441 <dt><code>--with-suexec-safepath=<em>PATH</em></code></dt> 442 443 <dd>Define a safe PATH environment to pass to CGI 444 executables. Default value is 445 "<code>/usr/local/bin:/usr/bin:/bin</code>".</dd> 446 </dl> 447 448 <h3>Compiling and installing the suEXEC wrapper</h3> 449 450 451 <p>If you have enabled the suEXEC feature with the 452 <code>--enable-suexec</code> option the <code>suexec</code> binary 453 (together with Apache itself) is automatically built if you execute 454 the <code>make</code> command.</p> 455 456 <p>After all components have been built you can execute the 457 command <code>make install</code> to install them. The binary image 458 <code>suexec</code> is installed in the directory defined by the 459 <code>--sbindir</code> option. The default location is 460 "/usr/local/apache2/bin/suexec".</p> 461 462 <p>Please note that you need <strong><em>root 463 privileges</em></strong> for the installation step. In order 464 for the wrapper to set the user ID, it must be installed as 465 owner <code><em>root</em></code> and must have the setuserid 466 execution bit set for file modes.</p> 467 468 469 <h3>Setting paranoid permissions</h3> 470 471 472 <p>Although the suEXEC wrapper will check to ensure that its 473 caller is the correct user as specified with the 474 <code>--with-suexec-caller</code> <code class="program"><a href="./programs/configure.html">configure</a></code> 475 option, there is 476 always the possibility that a system or library call suEXEC uses 477 before this check may be exploitable on your system. To counter 478 this, and because it is best-practise in general, you should use 479 filesystem permissions to ensure that only the group Apache 480 runs as may execute suEXEC.</p> 481 482 <p>If for example, your web server is configured to run as:</p> 483 484 <div class="example"><p><code> 485 User www<br /> 486 Group webgroup<br /> 487 </code></p></div> 488 489 <p>and <code class="program"><a href="./programs/suexec.html">suexec</a></code> is installed at 490 "/usr/local/apache2/bin/suexec", you should run:</p> 491 492 <div class="example"><p><code> 493 chgrp webgroup /usr/local/apache2/bin/suexec<br /> 494 chmod 4750 /usr/local/apache2/bin/suexec<br /> 495 </code></p></div> 496 497 <p>This will ensure that only the group Apache runs as can even 498 execute the suEXEC wrapper.</p> 499 500 </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div> 501 <div class="section"> 502 <h2><a name="enable" id="enable">Enabling & Disabling 503 suEXEC</a></h2> 504 505 <p>Upon startup of Apache, it looks for the file 506 <code class="program"><a href="./programs/suexec.html">suexec</a></code> in the directory defined by the 507 <code>--sbindir</code> option (default is 508 "/usr/local/apache/sbin/suexec"). If Apache finds a properly 509 configured suEXEC wrapper, it will print the following message 510 to the error log:</p> 511 512 <div class="example"><p><code> 513 [notice] suEXEC mechanism enabled (wrapper: <var>/path/to/suexec</var>) 514 </code></p></div> 515 516 <p>If you don't see this message at server startup, the server is 517 most likely not finding the wrapper program where it expects 518 it, or the executable is not installed <em>setuid root</em>.</p> 519 520 <p>If you want to enable the suEXEC mechanism for the first time 521 and an Apache server is already running you must kill and 522 restart Apache. Restarting it with a simple HUP or USR1 signal 523 will not be enough. </p> 524 <p>If you want to disable suEXEC you should kill and restart 525 Apache after you have removed the <code class="program"><a href="./programs/suexec.html">suexec</a></code> file.</p> 526 </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div> 527 <div class="section"> 528 <h2><a name="usage" id="usage">Using suEXEC</a></h2> 529 530 <p>Requests for CGI programs will call the suEXEC wrapper only if 531 they are for a virtual host containing a <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code> directive or if 532 they are processed by <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code>.</p> 533 534 <p><strong>Virtual Hosts:</strong><br /> One way to use the suEXEC 535 wrapper is through the <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code> directive in 536 <code class="directive"><a href="./mod/core.html#virtualhost">VirtualHost</a></code> definitions. By 537 setting this directive to values different from the main server 538 user ID, all requests for CGI resources will be executed as the 539 <em>User</em> and <em>Group</em> defined for that <code class="directive"><a href="./mod/core.html#virtualhost"><VirtualHost></a></code>. If this 540 directive is not specified for a <code class="directive"><a href="./mod/core.html#virtualhost"><VirtualHost></a></code> then the main server userid 541 is assumed.</p> 542 543 <p><strong>User directories:</strong><br /> Requests that are 544 processed by <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code> will call the suEXEC 545 wrapper to execute CGI programs under the userid of the requested 546 user directory. The only requirement needed for this feature to 547 work is for CGI execution to be enabled for the user and that the 548 script must meet the scrutiny of the <a href="#model">security 549 checks</a> above. See also the 550 <code>--with-suexec-userdir</code> <a href="#install">compile 551 time option</a>.</p> </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div> 552 <div class="section"> 553 <h2><a name="debug" id="debug">Debugging suEXEC</a></h2> 554 555 <p>The suEXEC wrapper will write log information 556 to the file defined with the <code>--with-suexec-logfile</code> 557 option as indicated above. If you feel you have configured and 558 installed the wrapper properly, have a look at this log and the 559 error_log for the server to see where you may have gone astray.</p> 560 561 </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div> 562 <div class="section"> 563 <h2><a name="jabberwock" id="jabberwock">Beware the Jabberwock: 564 Warnings & Examples</a></h2> 565 566 <p><strong>NOTE!</strong> This section may not be 567 complete. For the latest revision of this section of the 568 documentation, see the Apache Group's <a href="http://httpd.apache.org/docs/2.2/suexec.html">Online 569 Documentation</a> version.</p> 570 571 <p>There are a few points of interest regarding 572 the wrapper that can cause limitations on server setup. Please 573 review these before submitting any "bugs" regarding suEXEC.</p> 574 575 <ul> 576 <li><strong>suEXEC Points Of Interest</strong></li> 577 578 <li> 579 Hierarchy limitations 580 581 <p class="indent"> 582 For security and efficiency reasons, all suEXEC requests 583 must remain within either a top-level document root for 584 virtual host requests, or one top-level personal document 585 root for userdir requests. For example, if you have four 586 VirtualHosts configured, you would need to structure all 587 of your VHosts' document roots off of one main Apache 588 document hierarchy to take advantage of suEXEC for 589 VirtualHosts. (Example forthcoming.) 590 </p> 591 </li> 592 593 <li> 594 suEXEC's PATH environment variable 595 596 <p class="indent"> 597 This can be a dangerous thing to change. Make certain 598 every path you include in this define is a 599 <strong>trusted</strong> directory. You don't want to 600 open people up to having someone from across the world 601 running a trojan horse on them. 602 </p> 603 </li> 604 605 <li> 606 Altering the suEXEC code 607 608 <p class="indent"> 609 Again, this can cause <strong>Big Trouble</strong> if you 610 try this without knowing what you are doing. Stay away 611 from it if at all possible. 612 </p> 613 </li> 614 </ul> 615 616 </div></div> 617 <div class="bottomlang"> 618 <p><span>Available Languages: </span><a href="./en/suexec.html" title="English"> en </a> | 619 <a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Français"> fr </a> | 620 <a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> | 621 <a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean"> ko </a> | 622 <a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="Türkçe"> tr </a></p> 623 </div><div class="top"><a href="#page-header"><img src="./images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div> 624 <script type="text/javascript"><!--//--><![CDATA[//><!-- 625 var comments_shortname = 'httpd'; 626 var comments_identifier = 'http://httpd.apache.org/docs/2.2/suexec.html'; 627 (function(w, d) { 628 if (w.location.hostname.toLowerCase() == "httpd.apache.org") { 629 d.write('<div id="comments_thread"><\/div>'); 630 var s = d.createElement('script'); 631 s.type = 'text/javascript'; 632 s.async = true; 633 s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier; 634 (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s); 635 } 636 else { 637 d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>'); 638 } 639 })(window, document); 640 //--><!]]></script></div><div id="footer"> 641 <p class="apache">Copyright 2017 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> 642 <p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossary</a> | <a href="./sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!-- 643 if (typeof(prettyPrint) !== 'undefined') { 644 prettyPrint(); 645 } 646 //--><!]]></script> 647 </body></html>