Apache+SuexecでForbidden
Apache 2.4.18 + PHP 5.6.18 で Suexec
VirtualHost & Suexecを用いて、PHPの実行権を
各VirtualHostで異なるようにしたいのですが
gdtest.php を /usr/local/apache2/htdocs に置いて
http://172.16.72.152/gdtest.php では正常動作しますが
gdtest.php を /home/user1/public_html に置いて
http://dummy-host1.XXXXXXX.jp/gdtest.php では
Forbidden You don't have permission to access
/php-user1/php_user-cgi/gdtest.php on this server
と表示されます。
以下に当方の情報をお示しますので、どこが間違っているのか
ご指摘いだだけますようお願いいたします。
1.Apache config
./configure --prefix=/usr/local/apache2 \
--with-apr=/usr/local/apr/apr-1.5.2 \
--with-apr-util=/usr/local/apr-util/apr-util-1.5.4 \
--with-pcre=/usr/local/pcre/pcre-8.38 \
--with-mpm=prefork \
--with-suexec-userdir=public_html \
--with-suexec-docroot=/home \
--with-suexec-caller=daemon \
--enable-suexec
apache は User daemon, Group daemon で動作する
2.PHP config
phpinfo()で確認
Configure Command : './configure' '--enable-mbstring=ja' '--enable-bcmath'
'--with-gd' '--with-freetype-dir=/usr/include/'
'--with-png-dir=/usr/include' '--with-jpeg-dir=/usr/include'
Server API : CGI/FastCGI
Virtual Directory Support : disabled
Loaded Configuration File : /usr/local/lib/php.ini
:
3.Virtual Hostは正常動作
/usr/local/apache2/conf/extra/httpd-vhosts.conf
# 1st priority
<VirtualHost 172.16.72.152:80>
ServerAdmin root@172.16.72.152
DocumentRoot "/usr/local/apache2/htdocs"
ServerName 172.16.72.152:80
ErrorLog "logs/error_log"
CustomLog "logs/access_log" common
ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/"
<Directory "/usr/local/apache2/htdocs">
Options Indexes FollowSymLinks
AllowOverride All
Action php56 /cgi-bin/php56-cgi
AddHandler php56 .php
Require all granted
</Directory>
</VirtualHost>
# 2nd priority
<VirtualHost 172.16.72.152:80>
ServerAdmin root@172.16.72.152
DocumentRoot "/home/user1/public_html"
ServerName dummy-host1.XXXXXXX.jp
ErrorLog "logs/dummy-host1-error_log"
CustomLog "logs/dummy-host1-access_log" common
SuexecUserGroup user1 user1
ScriptAlias /cgi-bin/ "/home/user1/cgi-bin/"
Action php_user1 /cgi-bin/php_user1-cgi
AddHandler php_user1 .php
<Directory "/home/user1/public_html">
Options Indexes FollowSymLinks Includes ExecCGI
AllowOverride All
Require all granted
</Directory>
</VirtualHost>
4.suexec -V
-D AP_DOC_ROOT="/home"
-D AP_GID_MIN=100
-D AP_HTTPD_USER="daemon"
-D AP_LOG_EXEC="/usr/local/apache2/logs/suexec_log"
-D AP_SAFE_PATH="/usr/local/bin:/usr/bin:/bin"
-D AP_UID_MIN=100
-D AP_USERDIR_SUFFIX="public_html"
5. httpd -M
Loaded Modules:
core_module (static)
so_module (static)
http_module (static)
mpm_prefork_module (static)
authn_file_module (shared)
authn_core_module (shared)
authz_host_module (shared)
authz_groupfile_module (shared)
authz_user_module (shared)
authz_core_module (shared)
access_compat_module (shared)
auth_basic_module (shared)
reqtimeout_module (shared)
filter_module (shared)
mime_module (shared)
log_config_module (shared)
env_module (shared)
headers_module (shared)
setenvif_module (shared)
version_module (shared)
unixd_module (shared)
status_module (shared)
autoindex_module (shared)
suexec_module (shared)
cgid_module (shared)
vhost_alias_module (shared)
dir_module (shared)
actions_module (shared)
userdir_module (shared)
alias_module (shared)
6. directory, file関係
755 user1 user1 /home/user1/cgi-bin <-- daemon でも変わらない
755 user1 user1 /home/user1/cgi-bin/php_user1-cgi
cgi版phpである /usr/local/apache2/cgi-bin/pgp56-cgi を php_user1-cgi としてコピー
755 user1 user1 /home/user1/public_html/gdtest.php
/home, /home/user1 もパーミッションは 755
7. log messages
172.16.72.152 - - [09/Feb/2016:15:13:30 +0900] "GET /gdtest.php HTTP/1.1" 403 241
[/usr/local/apache2/logs/dummy-host1-error_log]
[Tue Feb 09 15:13:] [authz_core:error] [pid 4905] [client 172.16.72.152:43902] AH01630: client denied by server configuration: /home/user1/cgi-bin/php_user1-cgi
