Настройка SuExec Apache 2.2 + Nginx под PHP 5.3 ака Fast CGI в CentOS 5,6

./configure --help
./configure --with-apxs2=/usr/sbin/apxs --enable-suexec --with-suexec-bin=/usr/sbin/suexec \
    --with-suexec-caller=apache --with-suexec-userdir=www --with-suexec-docroot=/home --enable-so
make install clean

[root@remotehelp ~]# yum list | grep php-common
php-common.i386 5.3.15-7.el5.art installed
 
[root@remotehelp ~]# yum list | grep mod_fcgid
mod_fcgid.i386 2.3.6-3.el5.art atomic
mod_fcgid-selinux.i386 2.3.5-2.el5.art atomic
 
[root@remotehelp ~]# yum install mod_fcgid
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* atomic: mir01.syntis.net
* base: mirror.netcologne.de
* extras: mirror.netcologne.de
* rpmforge: nl.mirror.eurid.eu
* updates: be.mirror.eurid.eu
Excluding Packages from Red Hat Enterprise Linux 5 - i386 - ATrpms
Finished
Reducing Red Hat Enterprise Linux 5 - i386 - ATrpms to included packages only
Finished
Excluding Packages from Red Hat Enterprise Linux 5 - i386 - ATrpms testing
Finished
Reducing Red Hat Enterprise Linux 5 - i386 - ATrpms testing to included packages
only
Finished
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package mod_fcgid.i386 0:2.3.6-3.el5.art set to be updated
--> Finished Dependency Resolution
 
Dependencies Resolved
 
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
mod_fcgid i386 2.3.6-3.el5.art atomic 76 k
 
Transaction Summary
================================================================================
Install 1 Package(s)
Upgrade 0 Package(s)
 
Total download size: 76 k
Is this ok [y/N]: y
Downloading Packages:
mod_fcgid-2.3.6-3.el5.art.i386.rpm | 76 kB 00:00
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : mod_fcgid 1/1
 
Installed:
mod_fcgid.i386 0:2.3.6-3.el5.art
 
Complete!
[root@remotehelp ~]#

[root@remotehelp ~]# httpd -V
Server version: Apache/2.2.3
Server built: Jun 6 2012 10:00:36
Servers Module Magic Number: 20051115:3
Server loaded: APR 1.2.7, APR-Util 1.2.7
Compiled using: APR 1.2.7, APR-Util 1.2.7
Architecture: 32-bit
Server MPM: Prefork
threaded: no
forked: yes (variable process count)
Server compiled with....
-D APACHE_MPM_DIR="server/mpm/prefork"
-D APR_HAS_SENDFILE
-D APR_HAS_MMAP
-D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
-D APR_USE_SYSVSEM_SERIALIZE
-D APR_USE_PTHREAD_SERIALIZE
-D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
-D APR_HAS_OTHER_CHILD
-D AP_HAVE_RELIABLE_PIPED_LOGS
-D DYNAMIC_MODULE_LIMIT=128
-D HTTPD_ROOT="/etc/httpd"
-D SUEXEC_BIN="/usr/sbin/suexec"
-D DEFAULT_PIDLOG="run/httpd.pid"
-D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
-D DEFAULT_LOCKFILE="logs/accept.lock"
-D DEFAULT_ERRORLOG="logs/error_log"
-D AP_TYPES_CONFIG_FILE="conf/mime.types"
-D SERVER_CONFIG_FILE="conf/httpd.conf"
 
[root@remotehelp ~]# suexec -V
-D AP_DOC_ROOT="/var/www"
-D AP_GID_MIN=100
-D AP_HTTPD_USER="apache"
-D AP_LOG_EXEC="/var/log/httpd/suexec.log"
-D AP_SAFE_PATH="/usr/local/bin:/usr/bin:/bin"
-D AP_UID_MIN=500
-D AP_USERDIR_SUFFIX="public_html"

<FilesMatch "conf[a-z]*\.(php[3-6]*|ini)$">
    Order allow,deny
    Deny from all
</FilesMatch>

mv /etc/httpd/conf.d/php.conf /etc/httpd/conf.d/php.conf.bak
 
#
# PHP is an HTML-embedded scripting language which attempts to make it
# easy for developers to write dynamically generated webpages.
#
<IfModule prefork.c>
    LoadModule php5_module modules/libphp5.so
</IfModule>
<IfModule worker.c>
    LoadModule php5_module modules/libphp5-zts.so
</IfModule>
 
#
# Cause the PHP interpreter to handle files with a .php extension.
#
AddHandler php5-script .php
AddType text/html .php
 
#
# Add index.php to the list of files that will be served as directory
# indexes.
#
DirectoryIndex index.php
 
#
# Uncomment the following line to allow PHP to pretty-print .phps
# files as PHP source code:
#
#AddType application/x-httpd-php-source .phps

vi /etc/httpd/conf.d/fcgid.conf
 
# This is the Apache server configuration file for providing FastCGI support
# through mod_fcgid
#
# Documentation is available at
# http://httpd.apache.org/mod_fcgid/mod/mod_fcgid.html
 
LoadModule fcgid_module modules/mod_fcgid.so
 
# Use FastCGI to process .fcg .fcgi & .fpl scripts
# Don't do this if mod_fastcgi is present, as it will try to do the same thing
<IfModule mod_fcgid.c>
    DirectoryIndex index.php index.phtml
 
    PHP_Fix_Pathinfo_Enable 1
    IPCCommTimeout 180
    MaxProcessCount 150
    DefaultMaxClassProcessCount 15
    DefaultMinClassProcessCount 5
 
    Alias /fcgi-bin/ /var/www/cgi-bin/
    <Location /fcgi-bin/>
        SetHandler fcgid-script
        Options +ExecCGI
    </Location>
 
    AddHandler php-fcgi .php .php3 .php4 .php5 .phtml
    Action php-fcgi /fcgi-bin/php-fcgi-wrapper
    FCGIWrapper /var/www/cgi-bin/php-fcgi-wrapper .php
 
    # Sane place to put sockets and shared memory file
    SocketPath /var/run/mod_fcgid
    SharememPath /var/run/mod_fcgid/fcgid_shm
</IfModule>

# vi /var/www/cgi-bin/php-fcgi-wrapper
#!/bin/sh
export PHPRC=/etc
export PHP_FCGI_MAX_REQUESTS=5000
export PHP_FCGI_CHILDREN=1
exec /usr/bin/php-cgi
 
# chmod 755 /var/www/cgi-bin/php-fcgi-wrapper

mkdir /etc/httpd/conf.v
vi /etc/httpd/conf.v/default.conf
 
NameVirtualHost *:81
 
<VirtualHost *:81>
    ServerAdmin support@remotehelp.pp.ua
    DocumentRoot /var/www/html/
    ServerName localhost
    <Directory /var/www/html/>
        AllowOverride All
    </Directory>
</VirtualHost>

# Add user
adduser wrs
 
# Create directory
mkdir /var/www/wrs /var/www/wrs/public_html /var/www/wrs/logs /var/www/wrs/php
 
# Create fcgi wrapper
vi /var/www/wrs/php/php-fcgi-wrapper
 
#!/bin/sh
export PHPRC=/var/www/wrs/php
export PHP_FCGI_MAX_REQUESTS=5000
export PHP_FCGI_CHILDREN=1
exec /usr/bin/php-cgi
 
# Create user php.ini
touch /var/www/wrs/php/php.ini
chown -R root:wrs /var/www/wrs/php/php.ini
chmod 640 /var/www/wrs/php/php.ini
 
# Set user permission
chown -R wrs:wrs /var/www/wrs
chmod 750 /var/www/wrs/php/php-fcgi-wrapper

[root@remotehelp ~]# vi /etc/nginx/conf.d/wrs.conf
 
server {
    limit_conn addr 10;
    listen 80;
    server_name itadmin.org.ua www.itadmin.org.ua;
 
    #charset koi8-r;
 
    location ~* \.(jpg|jpeg|gif|png|ico|css|bmp|swf|js|mp3|zip|rar|gz|tgz)$
    {
        expires 1d;
        add_header Cache-Control public;
        proxy_pass http://localhost:81;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
 
    location / 
    {
        proxy_pass http://localhost:81;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
 
    #error_page 404 /404.html;
 
    #location = /404.html {
    # root /usr/share/nginx/html;
    #}
 
    # redirect server error pages to the static page /50x.html
    #
    #error_page 500 502 503 504 /50x.html;
    #location = /50x.html {
    # root /usr/share/nginx/html;
    #}
 
    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    # proxy_pass http://127.0.0.1;
    #}
 
    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    #location ~ \.php$ {
    # root html;
    # fastcgi_pass 127.0.0.1:9000;
    # fastcgi_index index.php;
    # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
    # include fastcgi_params;
    #}
 
    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    # deny all;
    #}
}
 
[root@remotehelp ~]# httpd -t
Syntax OK
 
[root@remotehelp ~]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
 
[root@remotehelp ~]# service httpd restart
Stopping httpd: [ OK ]
Starting httpd: [ OK ]
[root@remotehelp ~]# service nginx restart
Stopping nginx: [ OK ]
Starting nginx: [ OK ]
[root@remotehelp ~]#

<?php 
echo "I am running as user=";
system("whoami");
echo "<P>I can write here= ";
system("pwd");
$fname="write_test.txt";
if (file_exists($fname)) {
    echo "<P> I found file $fname and will delete it";
    unlink($fname);
    echo "...Done";
}
echo "<P>I'm writing new file $fname";
system ("touch $fname");

I am running as user=wrs 
 
I can write here= /var/www/wrs/public_html 
 
I'm writing new file write_test.txt

[root@remotehelp ~]# ls -la /var/www/wrs/public_html
total 16
drwxr-xr-x 2 wrs wrs 4096 Aug 19 13:47 .
drwxr-xr-x 5 wrs wrs 4096 Aug 19 11:02 ..
-rw-r--r-- 1 wrs wrs 17 Aug 19 09:02 index.html
-rw-r--r-- 1 wrs wrs 334 Aug 19 09:55 index.php
-rw-r--r-- 1 wrs wrs 0 Aug 19 13:47 write_test.txt

[root@remotehelp ~]# ls -la /usr/sbin/suexec
-r-s--x--- 1 root apache 11608 Jun 6 18:04 /usr/sbin/suexec
 
или же:
 
[root@remotehelp ~]# chgrp apache /usr/sbin/suexec
[root@remotehelp ~]# chmod 4750 /usr/sbin/suexec
[root@remotehelp ~]# ls -la /usr/sbin/suexec
-rwsr-x--- 1 root apache 11608 Jun 6 18:04 /usr/sbin/suexec

# Sane place to put sockets and shared memory file
SocketPath /var/run/mod_fcgid
SharememPath /var/run/mod_fcgid/fcgid_shm
# или
FcgidIPCDir /var/run/mod_fcgid
FcgidProcessTableFile /var/run/mod_fcgid/fcgid_shm

chown root:wrs /var/www/wrs/php/php.ini

<IfModule mod_fcgid.c>
    FcgidMaxRequestLen 1000000
</IfModule>
 
или:
 
<IfModule mod_fcgid.c>
    MaxRequestLen 1000000
</IfModule>