使用suphp来执行php

1、yum安装环境

apache php 都是用Yum安装

# yum install httpd php php-cli

保证php有php-cgi，因为suphp需要php的执行模式为cgi/fastcgi

[vnp.unscnb.com:/root]#php -v

PHP 5.2.6 (cli) (built: May  5 2008 10:32:59)

Copyright (c) 1997-2008 The PHP Group

Zend Engine v2.2.0, Copyright (c) 1998-2008 Zend Technologies

[vnp.unscnb.com:/root]#php-cgi -v

PHP 5.2.6 (cgi-fcgi) (built: May  5 2008 10:29:53)

Copyright (c) 1997-2008 The PHP Group

Zend Engine v2.2.0, Copyright (c) 1998-2008 Zend Technologies

Suphp安装

# wgethttp://www.suphp.org/download/suphp-0.7.1.tar.gz

#tar zvxf suphp-0.7.1.tar.gz

#cd suphp-0.7.1

Suphp的编译参数有2种 主要是setid-mode的区别

1、测试模式，没有任何安全所言

#./configure --prefix=/usr/local/suphp \

--sysconfdir=/usr/local/suphp/etc \

--with-apache-user=apache \

--with-setid-mode=owner \

--with-apxs=/usr/sbin/apxs \

--with-apr=/usr/bin/apr-1-config

2、生产模式使用下面的配置

#./configure --prefix=/usr/local/suphp \

--sysconfdir=/usr/local/suphp/etc \

--with-apache-user=apache \

--with-setid-mode=paranoid
\

--with-apxs=/usr/sbin/apxs \

--with-apr=/usr/bin/apr-1-config

具体2者的区别 将在后面apache配置那里说明

# make

# make install

# mkdir/usr/local/suphp/etc

#cp doc/suphp.conf-example /usr/local/suphp/etc/suphp.conf

编辑suphp.conf

# vi/usr/local/suphp/etc/suphp.conf

###########----------------------------------

[global]

;日志文件的产生路径

logfile=/var/log/httpd/suphp.log

;日志级别"info", "warn", "error", "none".

loglevel=info

;User Apache is running as

webserver_user=apache

;Path all scripts have to be in

docroot=/

;Path to chroot() to before executing script

;chroot=/mychroot

;安全选项，根据自己需要开启

;allow_file_group_writeable=false

allow_file_group_writeable=true

allow_file_others_writeable=false

;allow_directory_group_writeable=false

allow_directory_group_writeable=true

allow_directory_others_writeable=false

;Check wheter script is within DOCUMENT_ROOT

check_vhost_docroot=true

;check_vhost_docroot=false

;Send minor error messages to browser

errors_to_browser=false

;PATH environment variable

env_path=/bin:/usr/bin

;Umask to set, specify in octal notation

umask=0077

;最小uid和最下gid是指web运行的用户和组必须大于等于这个数，否则由于安全员应无法运行，这个设置根据自己来设置，一般uid=500 gid=100

min_uid=1000

min_gid=1000

[handlers]

;必须执行cgi模式的php，这个很重要

;x-httpd-php="php:/usr/bin/php"

x-httpd-php="php:/usr/bin/php-cgi"

;Handler for CGI-scripts

x-suphp-cgi="execute:!self"

##################---------------------------------------

整合apache

注销所有原先php和apache的配置选项，包括模块

# vi /etc/httpd/conf.d/suphp.conf

####--------------

LoadModule suphp_module modules/mod_suphp.so

NameVirtualHost *:80

<VirtualHost *:80>  

    ServerName 127.0.0.1

    DocumentRoot /var/www/svnadmin

DirectoryIndex index.php

#开启suphp引擎

suPHP_Engine on  

#指定/var/www/svnadmin的运行用户和组

suPHP_UserGroup webtest1 suphp

#指定执行的扩展名

    AddHandler x-httpd-php .php .php3 .php4 .php5  

suPHP_AddHandler x-httpd-php

#指定php的配置文件

    suPHP_ConfigPath /etc/php.ini

</VirtualHost>

###########-------------

需要注意的事项

1、假设apache设置的DocumentRoot "/var/www/html",那么/var/www的目录的所有者和组必须是root:root权限一般设置755

2、所有的虚拟主机web目录，必须放置在/var/www下，不能放置在apache设置的DocumentRoot目录下

3、假设我有一个/webserver/www/test的虚拟主机，此时/webserver/www的宿主和组必须是root:root

测试是否成功

编写index.php

<?

Phpinfo();

?>

打开web浏览发现

就表示成功

2、源码安装

suphp比suexec（就是原来dv3.0升php5的方法）要快一点；比suphp更快的还有suphp_mod_php；再快一些的是mpm-peruser，不过安装配置的麻烦程度也随之递增。

相比而言，suPHP速度还算可以接受（对于负载不是很大的站），配置方便，不用修改每个virtualhost的参数（就是$HOME/conf/vhost.conf），直接改apache的总conf就ok了，当然也比上面fastcgi方式下用event触发脚本来实现更加简洁。

ApacheSuexec

1、yum安装

#cd /etc/yum.repos.d/
#wgethttp://centos.karan.org/kbsingh-CentOS-Extras.repo

... and setgpgcheckto0andenabledto1in the[kbs-CentOS-Testing]section:

[...]

[kbs-CentOS-Testing]

name=CentOS.Karan.Org-EL$releasever - Testing

gpgcheck=0

gpgkey=http://centos.karan.org/RPM-GPG-KEY-karan.org.txt

enabled=1

baseurl=http://centos.karan.org/el$releasever/extras/testing/$basearch/RPMS/

#yum install httpd mod_fcgid php-cli

整合apache

注销所有原先php和apache的配置选项，包括模块

在php.ini的最后加上下面的语句

cgi.fix_pathinfo = 1

#groupadd web1
#useradd -s /bin/false -d /var/www/web1 -m -g web1 web1
#chmod 755 /var/www/web1

#mkdir -p /var/www/web1/web
#chown web1:web1 /var/www/web1/web

We will run PHP using suExec; suExec's document root is /var/www, as the following command shows:

# /usr/sbin/suexec -V
-D AP_DOC_ROOT="/var/www"
-D AP_GID_MIN=100
-D AP_HTTPD_USER="apache"
-D AP_LOG_EXEC="/var/log/httpd/suexec.log"
-D AP_SAFE_PATH="/usr/local/bin:/usr/bin:/bin"
-D AP_UID_MIN=500
-D AP_USERDIR_SUFFIX="public_html"

Therefore we cannot call the PHP binary (/usr/bin/php-cgi) directly because it is located outside suExec's document root. As suExec does not allow symlinks, the only way to solve the problem is to create a wrapper script for each web site in a subdirectory of /var/www; the wrapper script will then call the PHP binary /usr/bin/php-cgi. The wrapper script must be owned by the user and group of each web site, therefore we need one wrapper script for each web site. I'm going to create the wrapper scripts in subdirectories of /var/www/php-fcgi-scripts, e.g. /var/www/php-fcgi-scripts/web1

#mkdir -p /var/www/php-fcgi-scripts/web1

#vi /var/www/php-fcgi-scripts/web1/php-fcgi-starter

#chmod 755 /var/www/php-fcgi-scripts/web1/php-fcgi-starter
#chown -R web1:web1 /var/www/php-fcgi-scripts/web1

#vi /etc/httpd/conf.d/fcgid.conf

#######################--------------------------------

# This is the Apache server configuration file for providing FastCGI support

# through mod_fcgid

#

# Documentation is available at http://fastcgi.coremail.cn/doc.htm

LoadModule fcgid_module modules/mod_fcgid.so

# Use FastCGI to process .fcg .fcgi & .fpl scripts

# Don't do this if mod_fastcgi is present, as it will try to do the same thing

#<IfModule !mod_fastcgi.c>

#    AddHandler fcgid-script fcg fcgi fpl

#</IfModule>

# Sane place to put sockets and shared memory file

SocketPath run/mod_fcgid

SharememPath run/mod_fcgid/fcgid_shm

IPCConnectTimeout 10

IPCCommTimeout 20

OutputBufferSize 0

MaxRequestsPerProcess 500

#AddHandler fcgid-script .fcgi .php

NameVirtualHost *:80

<VirtualHost *:80>

  ServerName fcgi.test.com

  DocumentRoot /var/www/fcgi

    SuexecUserGroup webcgi fcgi

    PHP_Fix_Pathinfo_Enable 1

   AddHandler fcgid-script .php

    <Directory /var/www/fcgi/>

      Options +ExecCGI

      AllowOverride All

      FCGIWrapper /var/www/php-fcgi-scripts/web1/php-fcgi-starter .php

      Order allow,deny

      Allow from all

    </Directory>

ServerSignature Off

</VirtualHost>

Q:Apache reports "SuexecUserGroup directive requires SUEXEC wrapper." warning during startup.
A:warning, 原因是错误的suEXEC权限设置。
查看 ：    # ls -la /usr/sbin/suexec
应该为： -rwsr-xr-x 1 root root 12064 2008-04-17 01:15 /usr/sbin/suexec
主要是s权限即UID。如果权限和上面的不一样，修改：
# sudo chown root:root /usr/sbin/suexec
# sudo chmod 4755 /usr/sbin/suexec

本文转自centos.blog.chinaunix.net

开启sftp功能方法

在/usr/local/directadmin/custombuild/files.list添加文件列表

/usr/lib64/libnss3.so
/usr/lib64/libnss_db.so
/usr/lib64/libnss_files.so
/usr/lib64/libnss_ldap.so
/usr/lib64/libnss_nisplus.so
/usr/lib64/libnssutil3.so
/usr/lib64/libnss_compat.so
/usr/lib64/libnss_dns.so
/usr/lib64/libnss_hesiod.so
/usr/lib64/libnss_nis.so
/usr/lib64/libnssckbi.so
/lib64/libnss_compat-2.5.so
/lib64/libnss_db-2.2.so
/lib64/libnss_dns-2.5.so
/lib64/libnss_files-2.5.so
/lib64/libnss_hesiod-2.5.so
/lib64/libnss_ldap-2.5.so
/lib64/libnss_nis-2.5.so
/lib64/libnss_nisplus-2.5.so
/lib64/libnss_compat.so.2
/lib64/libnss_db.so.2
/lib64/libnss_dns.so.2
/lib64/libnss_files.so.2
/lib64/libnss_hesiod.so.2
/lib64/libnss_ldap.so.2
/lib64/libnss_nis.so.2
/lib64/libnss_nisplus.so.2
 

 然后修改/usr/local/directadmin/custombuild/jail_user.sh

找到mkdir -p $USER_HOME/usr/bin并添加代码

mkdir -p $USER_HOME/dev
mknod $USER_HOME/dev/null c 1 3
chown $1:$1 $USER_HOME/dev/null

开启子用户的wget功能,ssh命令直接执行

echo /usr/bin/wget>/usr/local/directadmin/custombuild/files.list

最后执行更新指定用户使其生效

/usr/local/directadmin/custombuild/jail_user.sh username

这样就可以在其他地方使用sftp管理了！

RewriteEngine on
RewriteCond %{HTTP_HOST} ^jb4.net [NC]
RewriteRule ^(.*)$ http://www.jb4.net/$1 [L,R=301]

a

#!/bin/bash
 ftp -v -n 192.168.1.1 >> EOF
 user ftpuser passwd
type binary 
put filename //put上传文件
get  filename //get下载文件
bye
 EOF
 

FTP bash shell 脚本操作范例

system exec shell_exec proc_open passthru set_time_limit error_log ini_alter dl pfsockopen openlog syslog readlink symlink link leak popen escapeshellcmd apache_child_terminate apache_get_modules apache_get_version apache_getenv apache_note apache_setenv virtual mb_send_mail pcntl_exec socket_connect socket_create

#!/bin/bash
#By www.sexdiy.org
if [ `cat /proc/loadavg|awk '{print $1}'` '>' 3 ]; then /etc/init.d/apache restart; fi

yum install -y htop
htop

wget http://packages.sw.be/htop/htop-0.9-1.el5.rf.i386.rpm
rpm -ivh htop-0.9-1.el5.rf.i386.rpm
htop

根据hostloc上的高手指点后我已经将代码简化到极致了！ nginx的try_files功能非常强大，可以判断文件是否存在！ 通过try_files判断 当文件不存在就跳到@backend块上处理，这样伪静态的url就轻松搞定了！

location ~ .*\.(php|jsp|cgi|pl|py|php4|php5)?\$ {
include proxy.inc;
}
location / {
try_files \$uri @backend;
}
location @backend {
internal;
include proxy.inc;
}
location ~ .*\.(ftpquota|htaccess|htpasswd|asp|aspx|jsp|asa|mdb)?\$ {
deny all;

#proxy.inc 内容代码
proxy_connect_timeout 30s;
proxy_send_timeout   90;
proxy_read_timeout   90;
proxy_buffer_size    32k;
proxy_buffers     4 32k;
proxy_busy_buffers_size 64k;
proxy_pass http://127.0.0.1:81;
proxy_redirect     off;
proxy_hide_header  Vary;
proxy_set_header   Accept-Encoding '';
proxy_ignore_headers Set-Cookie Cache-Control Expires;
proxy_set_header   Host   $host;
proxy_set_header   Referer $http_referer;
proxy_set_header   Cookie $http_cookie;
proxy_set_header   X-Real-IP  $remote_addr;
proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
client_max_body_size 100m;
client_body_buffer_size 128k;

#/bin/bash
beans=`cat /proc/user_beancounters | grep priv`
max=`echo $beans | awk '{ print $4;}'`
use=`echo $beans | awk '{ print $2;}'`
let "per=$use*100/$max"
let "umb=$use/256"
let "tmb=$max/256"
let "fmb=$tmb - $umb"
echo $fmb

将代码保存为然后执行！

注:此代码只支持openvz架构的linux系统查询，不支持xen结构的！

等有时间把xen获取内存的方法搞定后就写一个控制系统资源在不足情况下自动回收的脚本！