Troubleshoot suPHP Permission Issues

Posted at November 11, 2016 at 1:00 pm by Jithin

suPHP requires folders and files to have a specific set of ownership and permissions for the proper functioning and handling of PHP scripts. While working with suPHP you will see a lot of errors like, “500 Internal Server Error”, “403 Forbidden error”, broken images, no JavaScript behaviors appear to work, and simple errors that will highlight the word “permission” in them. Tracking and fixing these errors are time consuming process and patience is required. These errors are common when switching from current PHP handler to suPHP handler. suPHP handler is a CGI based handler that usually runs PHP requests using suEXEC apache feature. suPHP is generally used by hosting companies as it offers additional security for the entire server. The server normally has a large number of domains and user accounts in it. Enabling suPHP will handle PHP requests using corresponding user account’s privileges. Sometimes poor configuration in suphp.conf leads to permission issues.

 

Sample SuPHP Configuration

1) Path to logfile

logfile=/var/log/suphp.log

2) User Apache is running as

webserver_user=wwwrun

3) Path all scripts have to be in

docroot=/var/www:${HOME}/public_html

4) Path to chroot() to before executing script

chroot=/mychroot

5) Security options

allow_file_group_writeable=false

allow_file_others_writeable=false

allow_directory_group_writeable=false

allow_directory_others_writeable=false

6) Check wheter script is within DOCUMENT_ROOT

check_vhost_docroot=true

7) Send minor error messages to browser

errors_to_browser=false

8) PATH environment variable

env_path=”/bin:/usr/bin”

7) Umask to set, specify in octal notation

umask=0077

8) Minimum UID

min_uid=100

9) Minimum GID

min_gid=100

10) Handler for php-scripts

x-httpd-php=”php:/usr/bin/php”

11) Handler for CGI-scripts

x-suphp-cgi=”execute:!self”

 

Troubleshooting

suPHP will prevent any PHP files with world-writable permissions from being run. Most files and folders can have permissions set up to 644 and 755 respectively. All the files and folders must be owned by the particular user. We can set the permission of folder and files using following commands.

1) Change permissions for all folders to 755

find /home/*/public_html -type d -exec chmod 755 {} \;

2) Change permissions for all files to 644

find /home/*/public_html -type f -exec chmod 644 {} \;

3) Change permission for only php scripts to 600

find /home/*/public_html -type f -name *.php -exec chmod 600 {} \;

4) Remove any php_value and php_flag entries in .htaccess files

find /home -type f -name ‘.htaccess’ -exec grep -Hrn ‘php_value’ ‘{}’ \;

find /home -type f -name ‘.htaccess’ -exec grep -Hrn ‘php_flag’ ‘{}’ \;

 

Fixperms

Using this script the ownership of files and folders can be set to user:user which satisfy suPHP security conditions. This script is only compatible with cPanel servers and it is highly recommended to take complete backup of the server before running this script. The script runs in a quiet mode with minimal info by default. If you need to observe and know what is happening when the script is run, just turn on the verbosity and the script will display everything. To turn on the verbosity -v option can be used. To use fixperms login as root user and wget the file from the following link.

wget https://raw.githubusercontent.com/PeachFlame/cPanel-fixperms/master/fixperms.sh

Fixperms script can be run for a specific account or for all accounts, with or without verbosity.

 

Fixperms for single user

sh ./fixperms.sh -a user_name

sh ./fixperms.sh -v -a user_name

Fixperms for all users

sh ./fixperms.sh -all

sh ./fixperms.sh -v -all

 

Overview

Once suPHP is enabled, the following requirements should be checked and matched.

1) All files including php scripts have permissions of 644 and below

2) All folders have permissions of 755 and below

3) All php_flag and php_value entries in .htaccess file must be removed

4) The owner:group of all files and folders must be particular user

5) Complete server backup must be made before running fixperms script.

 

If you need any further assistance please contact our support department.

 

 

0.00 avg. rating (0% score) - 0 votes

You can skip to the end and leave a response. Pinging is currently not allowed.

Leave a Reply