Comments on: Using mpm-itk To Secure A Shared Server

By: tech.webportfolio.hu » Installing apache2-mpm-itk on a Virtualmin based Ubuntu 8.04

Mon, 01 Mar 2010 21:17:20 +0000

[...] So, I started to look for a solution, and luckily, I came across with Stuart Herbert’s Blog, and with the post of apache mpm-itk. [...]

By: Lawrence Williams

Lawrence Williams — Tue, 24 Nov 2009 15:07:57 +0000

Got mpm-itk working with Apache 2.2.14 on cPanel using the “series” of patches, not the monolithic one.

Everything works well, but just a quick warning: eAccelerator doesn’t work properly and will eat through gigs of RAM in a mere few minutes (not a problem when prefork is in use).

Haven’t tried xcache or APC yet.

By: Apache ITK mit mod_php und eingener php.ini « Benjamin B�rngen-Schmidt

Apache ITK mit mod_php und eingener php.ini « Benjamin B�rngen-Schmidt — Wed, 02 Sep 2009 15:55:58 +0000

[...] Prozess, unter diesem Benutzer ausgef�hrt. Einen sch�nen einf�hrenden Artikel zu Apache ITK hat Stuart Herbert in seinem Blog geschrieben. AssignUserID user [...]

By: Mark

Mark — Mon, 10 Aug 2009 14:46:10 +0000

This is a great blog! After several pages I’m trying to combine mpm-itk with mod-fcgid on Ubuntu (Hardy). The reason is that I would like to use mpm-itk combined the ability to use per-user php.ini files. Unfortunately I’m out of luck, as soon as I use AssignUserId I get these errors in Apache’s error log:

[emerg] (13)Permission denied: mod_fcgid: can’t get lock, pid: 9319

Is it possible at all to combine mpm-itk with mod-fcgid? Or is there a better way to use per-user (per VirtualHost) php.ini files together with mpm-itk?

Right now I’m using suPHP but when the server is busy this just eats my CPU.

By: G.Schuster

G.Schuster — Fri, 17 Jul 2009 01:37:31 +0000

[quote]As a result, your code is free to take advantage of any Apache features that aren�t available to PHP/CGI, such as HTTP authentication support.[/quote]
Well, there are ways to, at least, support HTTP auth within PHP with a little trick – Apaches RewriteMap is the key.
For a detailled explanation (sorry, available in German only) see the following forum topic: http://forum.webhostlist.de/forum/webserver-software-linux-unix-etc/102327-howto-php_auth_user-_pw-fuer-php-cgi.html

By: Running Vhosts Under Separate UIDs/GIDs With Apache2 mpm-itk On Ubuntu 9.04 | All Free For You

Tue, 30 Jun 2009 00:27:41 +0000

[...] For speed considerations, take a look at http://blog.stuartherbert.com/php/2008/04/19/using-mpm-itk-to-secure-a-shared-server/. [...]

By: Fuji

Fuji — Sat, 27 Jun 2009 00:17:05 +0000

Awesome group of articles Stuart. Had a couple of questions that I would love your input on

1) mpm-itk should be compatible with opcode cachers like APC right?

2) Have you tried php-fpm? From what I have read looks like it offers the same ability as suphp and doesnt take the performance hit (not sure if its faster than mpm-itk)

By: Stuart Herbert

Stuart Herbert — Tue, 23 Jun 2009 12:52:15 +0000

@ant: anything that relies on the user ‘nobody’ is fundamentally broken. ‘nobody’ is the user that the root user gets mapped to in more secure NFS environments.

You shouldn’t put sessions in /tmp, but if /tmp is setup correctly, there should be no reason why mpm-itk can’t access sessions stored in there.

By: Ant

Ant — Tue, 23 Jun 2009 10:42:24 +0000

Not so much a good solution for Cpanel. I gave it a shot. Worked great till i went to login cpanel. Returned internal server error 500. becaue the user cpanel logs in as nobody and the user isn’t allowed.

Also saw that no one could access the /tmp folder using sessions

By: Stuart Herbert

Stuart Herbert — Wed, 20 May 2009 08:12:01 +0000

@devrim I don’t think mpm-itk is the right solution for your problem. mpm-itk can control the Linux user that Apache runs as, but it can’t help you manage users within your PHP application.