Suexec and Apache: A Tutorial Page 8

The suexec wrapper isn't perfect, and some aspects of its design result in it being less than ideally suited to all environments. Here are some of the more common questions, changes, and enhancements that come up again and again:

Q:

The single --suexec-docroot value is irksome. I have 50 virtual hosts with DocumentRoot values like /vhost1, /vhost2, and so on. The only way I can get suexec to work with these is to use --suexec-docroot=/, which hardly seems secure.

A:

This is unfortunately the way it is with the suexec that comes with Apache up through version 1.3.11. The value you specify for --suexec-docroot must be an ancestor of all of the non-~username documents that use it. This restriction may be lifted in a future version, but even then it would require settings specified at compile-time, such as with something like --suexec-docroot=/vhost1,/vhost2.

Q:

I only want suexec to be used in certain directories or user accounts.

A:

As of Apache 1.3.11, suexec is an all-or-nothing proposition. If it's available and enabled, it will be used in all cases when a CGI script is invoked. A future version of Apache may provide a means of controlling this with greater granularity.

Q:

Why don't the Apache CGI error messages say there's a problem with suexec?

A:

Because Apache really doesn't know that for a fact. All it knows is that called an internal function to invoke the CGI, and the interaction with the script failed as described in the error message. The error might have been caused by a failure to meet suexec's requirements, or it may have been the result of a bona fide error in the script itself.

Q:

Why aren't suexec's error messages logged in the Apache server log?

A:

In order for the messages from suexec to appear in the main server's log, they would have to actually be passed to Apache so that Apache did the logging. Not only is this inappropriate for the Web server to do, but there would be additional confusion about into which error log the messages should go.

Going Further

There are a few articles on the Web about working with the suexec wrapper. Don't neglect the man page included with the source; you can view it directly with

    % cd ./apache-1.3/src/support/
    % man ./suexec.8
  



 You can also find some documentation at the following URLs: 





<URL:http://www.apache.org/docs/suexec.html>



<URL:http://www.apache.org/docs/suexec_1_2.html>
(this is largely obsolete)



In Conclusion




The suexec application is a double-edged sword. It allows you to
execute scripts under other personæ than the basic server
user--but it can also cut you unexpectedly if you're not careful. A single
misconfiguration can break all of your CGI scripts, so consider and plan
carefully, and test thoroughly, before implementing the wrapper on your
production systems. 


Got a Topic You Want Covered?