Re: [tlug] Apache & suexec

[Jim Breen <jwb@example.com>]

My question:
>> The problem is that we can't get CGIs firing. There are suexec error logs
>> saying there is a GID/UID mismatch (he has given me ownership of the 
>> cgi-bin directory. The friend has never configured Apache before.
>> 
>> Can anyone give some quick point-by-point tips on getting a basic 
>> Apache going with or without suexec? (I can't help much because I've never
>> done it.)

>> From: Brett Robson <b-robson@example.com>
>> 
>> I haven't had any problem and the only thing that springs mind is
>> if suexec us really running. This should be in the errolog, (not
>> the most obvious place to look)

Certainly suexec is running. I can see the errors pop up in the suexec
error log when I try & run scripts.

>> error_log.3:[Mon Feb 10 11:06:15 2003] [notice] suEXEC mechanism
>> enabled (wrapper: /usr/sbin/suexec)

Apparently the way to turn suexec on/off is to have the binary
present/absent. Apache invokes it if it is there.

>> Is it a virtual host? If so you'd need to have the user and group
>> in the conf file.

I don't think so. Yes I think we need the user and group in the conf file;
I was fishing for details to pass to the owner of the system, who is not
that keen to read 47 man pages.

>> From: Sam Tilders <sam@example.com>
>> 
>> For suExec to be active it needs the username and group to be specified in the 
>> httpd configuration. 
>> 
>> User fred
>> Group users
>> 
>> This is usually in the VirtualHost definition as suExec is about making things 
>> for that virtualhost run as a different user to the rest of the server (which 
>> is probably running as apache or nobody).

And if it's not VirtualHost? AFAIK it isn't - no-one else is using Apache
on this system. Some of my mirrors are VirtualHost, but the people running
them know the ropes.

>> The GID/UID mismatch error usually comes along if the user and group in the 
>> configuration and the user and group on something in the DocumentRoot don't 
>> match.
>> 
>> It can happen if the DocumentRoot directory itself, the cgi-bin or the cgi 
>> executable is not owned by the user/group specified.
>> 
>> Setting the appropriate ownerships on the files usually sorts it out.

Thanks Sam. I'll pass that to Jacek. Can I give him your email address?

Jim

-- 
Jim Breen  (j.breen@example.com  http://www.csse.monash.edu.au/~jwb/)
Computer Science & Software Engineering,                Tel: +61 3 9905 3298
Monash University, VIC 3800, Australia                  Fax: +61 3 9905 5146
(Monash Provider No. 00008C)                ジム・ブリーン@モナシュ大学