innerjoin

Requirements for suEXEC

The 'wrapper' Apache uses to run cgi scripts under dedicated accounts has some strict security requirements which define a lot of the further configuration choices:

• Apache runs scripts under dedicated accounts only if the application is a Virtual Host
  • OK, this is not 100% true as Apache/suEXEC also runs scripts in user html directories as the appropriate user.
• suEXEC will only runs scripts which are beneath its compiled-in 'docroot'
  • This is to stop Apache running a script from a random location in the filesystem. suEXEC even follows symlinks however, meaning that the script has to be physically installed beneath the docroot. Note that this docroot is not that specified to Apache in its configuration file, the DocumentRoot, it is a compiled-in value in suEXEC
• The user and group specified in the virtual host configuration must match the user and group 'ownership' of the script and the directory.
  • Apache can only run a script, using suEXEC, as its owner. The implication is that the script cannot have less rights when Apache is running it than the owner has when he or she is logged on.
• The dedicated user and group accounts for perlDesk have to have numeric id's greater then 100.
  • This is to stop Apache running a script under a 'system' or more privileged account (which are normally set up with a low id, below 100)

The compiled-in options for suEXEC can be listed with the -V option:

• /usr/sbin/suexec -V

The docroot for the RedHat 7.3 suEXEC is /var/www