Suexec and Apache: A Tutorial Page 6

By Ken Coar (Send Email)

and then restart the Apache server. Doing any one of these will render the suexec facility unusable, and Apache won't even try to involve it. To verify that your action has had the desired effect, verify (if you're running Apache 1.3.11 or later) with the "/usr/local/web/apache/bin/httpd -l" command. If the output says suexec is enabled, you haven't done enough yet.

Testing Your Installation

The simplest way to verify that suexec is functioning properly is to install a script that will tell you the username under which it's being invoked.

    # cd /usr/local/web/apache/cgi-bin/
    # cat > showuser.cgi << EOS
    #!/bin/sh
    echo "Content-type: text/plain"
    echo ""
    echo "Username="'whoami'
    EOS

    # chmod 755 showuser.cgi
    # chown user1.group1 . ./showuser.cgi

(By calling it "showuser.cgi" you can copy it directly into a user's directory without having to rename it. Filename extensions on scripts in ScriptAliased directories are ignored, so it does no harm to keep the .cgi extension.)

Note that the cgi-bin/ directory isn't under the DocumentRoot, which is why the --suexec-docroot value was bumped up one level--that way it covers both the ServerRoot (including the cgi-bin/ directory) and the DocumentRoot.

Since there are two ways in which suexec can be invoked, you should test both of them:

Server-wide suexecution: First, create a <VirtualHost> container (or use an existing one) in your server configuration files, and add User and Group directives to it. Pick some username and group that are different from the normal server user. Next, make sure that you have a ScriptAlias directive that points to the directory where you put your test script. Next, make sure that the cgi-bin/ directory and the test script are owned by the user and group you've chosen, and are mode 755. Finally, (re)start the Apache server and request the test script with some URL like <URL:http://myvirtualhost/cgi-bin/showuser.cgi>. If you get an error, examine the server error log and the suexec log.

User directory suexecution: To test that suexec will properly handle a CGI script in a user's directory, copy your showuser.cgi script into that user's public_html/ directory, make sure that both the script and the public_html/ directory itself are mode 755 and owned by the user, and then request the script with a URL such as <URL:http://myhost/~user/showuser.cgi>. If you get an error page, look at the Apache and suexec logs.

Debugging

Debugging a suexec problem can be frustrating, particularly since almost any problem with a CGI script in a suexec-enabled environment turns out to be related to the wrapper.

This article was originally published on Jul 12, 2000

Page 6 of 9