How do I change suexec doc root for use with virtual domains

[mrbinky3000]

Hello,

I appologize if this is a newbie-type question but I've been googling all day long and can't find an answer on my own.

I just installed Fedora Core 1 out of the box which set up Apache PHP and MySQL for me. I changed my httpd.conf file to use name based virtual domain hosting.

<VirtualHost XX.XX.XX.XX:80>
ServerAdmin XX@XX.net
DocumentRoot /home/amn/athensmusician.net/html
ServerName www.athensmusician.net
ServerAlias athensmusician.net
SuexecUserGroup amn amn
</VirtualHost>

The problem I am encountering now is that perl scripts fail when viewed through a web browser, but work just fine from the shell. Yes, the scripts have been converted with dos2unix. Yes, the permissions for the perl script are 700. Yes, I added "AddHandler cgi-script .cgi .pl" to my httpd.conf file. When I browse to the script, I get the following lines added to these logs.

Error Log:
[Tue May 18 02:40:06 2004] [error] [client XX.XX.XX.XX] Premature end of script headers: discuss.pl

SuEXEC Log:
[2004-05-18 02:40:06]: uid: (500/amn) gid: (500/500) cmd: discuss.pl
[2004-05-18 02:40:06]: command not in docroot (/home/amn/athensmusician.net/html/perl/discuss.pl)

Here is my SuEXEC setup.

% suexec -V
-D AP_DOC_ROOT="/var/www"
-D AP_GID_MIN=100
-D AP_HTTPD_USER="apache"
-D AP_LOG_EXEC="/var/log/httpd/suexec.log"
-D AP_SAFE_PATH="/usr/local/bin:/usr/bin:/bin"
-D AP_UID_MIN=500
-D AP_USERDIR_SUFFIX="public_html"

I read a post on another message board where a person had a similar problem. He set his doc root to /home and his scripts started working. He had to recompile Apache, but I have never done that before.

How do I recompile apache when it was installed via RPM with the initiall fedora core installation without destroying two days of hard work setting up the machine? Help!!!

- Matt

[bradthemad]

Here's how to rebuild Apache from SRPM, including the change you want to make.

1. Grab the httpd SRPM from the FC1 updates:

% wget http://download.fedora.us/fedora/fedora/1/i386/SRPMS.updates/httpd-2.0.48-1.2.src.rpm

2. Set up your RPM build area:

% echo "%_topdir /home/yourname/src/rpm" >> ~/.rpmmacros
% mkdir -p ~/src/rpm/
% cd ~/src/rpm
% mkdir BUILD RPMS RPMS/i386 SOURCES SPECS SRPMS

3. Install the SRPM:

% rpm -ivh ~/httpd-2.0.48-1.2.src.rpm

This will put the source tarball and patches in SOURCES, and a specfile (metadata and instructions for building) in SPECS.

4. Edit the specfile, bumping up the release number, changing the suexec docroot, and noting this in the changelog:

% vi SPECS/httpd.spec

line 8:
< Release: 1.2
> Release: 1.3

line 202:
< --with-suexec-docroot=%{contentdir} \
> --with-suexec-docroot=/home \

line 510:
%changelog
* Tue May 18 2004 Your Name <you@yours> 2.0.48-1.3
- Rebuilt with suexec-docroot set to /home instead of %{contentdir}

5. Rebuild httpd, creating both a binary RPM and a source SRPM:

% rpmbuild -ba SPECS/httpd.spec

You may have to install some additional packages to satisfy build dependencies here. When it's done, you'll have binary packages in RPMS/i386/, and a source package including your modified specfile in SRPMS/.

6. You can now either upgrade to the httpd you just compiled...

% sudo rpm -Fvh RPMS/i386/httpd*.rpm RPMS/i386/mod_ssl*.rpm

7. ...or simply extract the suexec binary and copy it over the original one:

% rpm2cpio RPMS/i386/httpd-2.0.48-1.3.i386.rpm | cpio -imVd ./usr/sbin/suexec
% sudo cp -p /usr/sbin/suexec /usr/sbin/suexec.orig
% sudo cp ./usr/sbin/suexec /usr/sbin/suexec
% sudo chown root:apache /usr/sbin/suexec
% sudo chmod 4510 /usr/sbin/suexec

Personally, I haven't yet had any problems with just keeping the suexec binary I compiled months ago and reusing it with later updates of Apache (i.e., repeat step 7 after installing an httpd update), YMMV. Obviously if there is ever a security update involving suexec itself, though, you should rebuild again.

[mrbinky3000]

Thanks a lot for the help. I have one more question before I try this. How do I find out how my current version of apache was compiled? Basically, my goal here is to match the current apache and suexec binary as closely as possible. I just want to change the suexec doc root and absolutely nothing else. I'm hoping this will my my recompile as smooth as possible.

Thanks again!

[mrbinky3000]

Never mind. I found out how discover how apache was compiled

% httpd -V
Server version: Apache/2.0.48
Server built: Nov 19 2003 08:36:12
Server's Module Magic Number: 20020903:4
Architecture: 32-bit
Server compiled with....
-D APACHE_MPM_DIR="server/mpm/prefork"
-D APR_HAS_SENDFILE
-D APR_HAS_MMAP
-D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
-D APR_USE_SYSVSEM_SERIALIZE
-D APR_USE_PTHREAD_SERIALIZE
-D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
-D APR_HAS_OTHER_CHILD
-D AP_HAVE_RELIABLE_PIPED_LOGS
-D HTTPD_ROOT="/etc/httpd"
-D SUEXEC_BIN="/usr/sbin/suexec"
-D DEFAULT_PIDLOG="logs/httpd.pid"
-D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
-D DEFAULT_LOCKFILE="logs/accept.lock"
-D DEFAULT_ERRORLOG="logs/error_log"
-D AP_TYPES_CONFIG_FILE="conf/mime.types"
-D SERVER_CONFIG_FILE="conf/httpd.conf"


Thanks again

[bradthemad]

How do I find out how my current version of apache was compiled? Basically, my goal here is to match the current apache and suexec binary as closely as possible. I just want to change the suexec doc root and absolutely nothing else. I'm hoping this will my my recompile as smooth as possible.

I figured as much, and that is precisely what you accomplish by recompiling from the Fedora SRPM. It was from this SRPM that the official Fedora httpd RPM was built. The procedure I outlined above will produce RPMs that are identical, except for the change to suexec. If you look through the specfile, you can see the ./configure they used.

[mthaddon]

Hi,

I was very glad to find your instructions, and followed them to the point of extracting the suexec binary. I think I'm making progress because I'm getting a different error message in the suexec.log:

I was getting:

[2004-08-31 15:07:50]: uid: (505/sympa) gid: (507/507) cmd: wwsympa.fcgi
[2004-08-31 15:07:50]: command not in docroot (/home/sympa/bin/wwsympa.fcgi)

and am now getting:

[2004-08-31 16:29:44]: uid: (505/sympa) gid: (507/507) cmd: wwsympa.fcgi
[2004-08-31 16:29:44]: file is either setuid or setgid: (/home/sympa/bin/wwsympa.fcgi)

the following is the file details:

[root@jabba rpm]# ls -l /usr/sbin/suexec
-r-s--x--- 1 root apache 13537 Aug 31 16:29 /usr/sbin/suexec


Any help appreciated.

Thanks, Tom