Joomla! Documentation™

Implementing suPHP

suPHP is an Apache module used to execute PHP scripts with the permissions of their file owners.

This is how the server will work thanks to suPHP:

• If a PHP file has the owner dexter, suPHP will execute that file as dexter and not as the Apache user www-data.
• If another file PHP file has the owner adam, suPHP will execute that file as adam and not as the Apache user www-data.
• If another file PHP file has the owner www-data, suPHP will execute that file as www-data which is the Apache user.
• If a folder has the owner dexter and it has a PHP file inside it with the owner adam, the server will throw a 500 error when some one tries to request that file because it does not belong to dexter.
• If any PHP script tries to read or write files or folders outside the server's document root, the server will deny the action.
• If a file has too permissive permissions such as chmod 666, the server will throw a 500 error because suPHP does not allow too permissive permissions for security reasons.

When suPHP installed, configure it with these steps:

• Open a terminal and enter:

sudo gedit /etc/suphp/suphp.conf

• Find the option docroot and set the location to your public_html folder:

docroot= /home/youruser/lamp/public_html

NOTE: You can place your new site folders at any location you desire. This is just an example. Replace youruser with your actual Linux username.

• Save changes
• Type in your terminal:

sudo gedit /etc/apache2/mods-available/php5.conf

• On your editor, create a new empty line at the first line of the document and add this text:

<Directory /usr/share>

• Then at the end of the document, create another empty line and add this text:

</Directory>

• As you can see, we just enclosed the original content withing those lines.
• Save changes
• Type in your terminal:

sudo service apache2 restart

• Let's create a file to do a quick test to see if suPHP is working correctly. Type in your terminal:

echo "<?php echo 'whoim = '.exec('/usr/bin/whoami');?>" | tee /home/youruser/lamp/public_html/whomi.php

• Open your browser and navigate to localhost/whomi.php. most likely the browser will show you a 500 server error. This is because suPHP does not allow too permissive file and folder permissions and also does not allow mixed file and folder ownership. To correct this type in your terminal:

sudo find /home/youruser/lamp/ -type f -exec chmod 644 {} \;
sudo find /home/youruser/lamp/ -type d -exec chmod 755 {} \;
sudo chown youruser:youruser -R /home/youruser/lamp/

NOTE: You can place your new site folders on any location you desire. This is just an example. Replace youruser with your actual Linux username.

Those commands enforce a secure and correct file and folder permission and also set a correct user and group ownership.

• Open your browser and navigate to localhost/whomi.php. You should see something like this:

whomi = youruser

That means the script is being executed with your user and not the Apache user unless you specified that.