hostby.net

A long time ago someone got fed up with suexec suphp and other methods of preventing virtual hosting users messing each others accounts up. They realised that the real problem was not that there was a module missing from Apache to do it, but rather the design of Apache is such that its impossible to make it secure in a per user way. After reading Stuart Herbert discussion of the pros and cons of different solutions to this problem and his evaluation of mpm-itk i decided to look into it further.

On nice solution that has been developed is mpm-peruser but that seemed to spawn a great many processes and have performance issues so I took a look at the much simpler mpm-itk. Fortunately on Debian this module is already prepackaged, unfortunately CentOS does not have a rpm for it, nor could I find one by searching. The only option left was to patch the source httpd rpm myself.

Unfortunately there is only a guide for CentOS 4 online, which does not work with CentOS 5. A little bit of searching on the CentOs wiki found me these two links

• http://www.owlriver.com/tips/non-root/
• http://www.owlriver.com/tips/patching_srpms/

The second was most useful as what we wanted to do was patch the SRPMS (Source RPMS) which are then compiled into RPMS. By looking though the Diff file posted in the previous guide I was able to produce a modified .spec file, which I have attached at the end of this article along with the final RPMS. Once we had the .spec file modified correctly I tried to compile the RPMs but came accross a very obsure error which was the result of the the latest mpm-itk patch not being compatable with the version of Apache that comes with CentOS 5. To work around this I had to locate the older patch which is not directly linked on the website. By a bit of googling and guesswork later I had found the location of the older patch.

After these shinnigans the RPMS compiled and it was time to test them. I soon realised I had to make a change to my /etc/sysconfig/httpd file to use the mpm-itk binary and edit httpd.conf to ensure I doesnt try to serve pages as the root user.

Anyway…here is the guide.

Standard Disclaimer myself and hostby.net take no responsibility for any damages, bad things or anything else that happens as the result of following this guide

First we ensure we are NOT the root user. Building RPMS as root is a bad idea.

Once we are using a non-root user, we first need to setup our RPM build enviroment.
cd
wget http://www.oldrpm.org/hintskinks/buildtree/RPM-build-tree.txt
chmod 755 RPM-build-tree.txt
./RPM-build-tree.txt

Now create our own buiding area and download CentOS 5 apache2 SRPM.
mkdir ~/build
mkdir ~/build/httpd-itk
cd ~/build/httpd-itk
wget http://isoredirect.centos.org/centos/5/os/SRPMS/httpd-2.2.3-11.el5_1.centos.3.src.rpm

At this point its good to test you can build the RPM normally before we apply any patches
rpmbuild --rebuild httpd-2.2.3-11.el5_1.centos.3.src.rpm

If this fails you might have to “yum install” some additional packages. I’m assuming you managed to get this to work so we continue.

At this point we copy the rpm spec file for httpd to our own folder so we can customise it
cp ~/rpmbuild/SPECS/httpd.spec httpd-itk.spec

To save you some effort I’ve provided both a diff and the .spec file i used. Basically you change the file to apply an additional patch and compile an extra mpm.

cd ~/rpmbuild/SOURCES
wget http://mpm-itk.sesse.net/apache2.2-mpm-itk-20070425-00.patch
nano apache2.2-mpm-itk-20070425-00.patch


I had to make one tiny change to the patch to make it compile.
after this line (1878)

+#define MPM_NOTE_CHILD_KILLED(i) (MPM_CHILD_PID(i) = 0)

Insert this extra row
+#define MPM_VALID_PID(p) (getpgid(p) == getpgrp())


Now we change back to our folder and use the spec file we modified (or the one i provided httpd-itk.spec) and recompile the rpm.
cd ~/build/httpd
rpmbuild -ba httpd-itk.spec

If all goes well this should compile with no errors. In the folder ~/rpmbuild/RPMS you should have a nice new set of RPMS which include mpm-itk. The only way to find out is of course to test it. Now we change to root
su
cd /home/userwebuildrpmsas/rpmbuild/RPMS
rpm -U httpd-2.2.3-11.itk.3.i386.rpm mod_ssl-2.2.3-11.itk.3.i386.rpm httpd-devel-2.2.3-11.itk.3.i386.rpm httpd-manual-2.2.3-11.itk.3.i386.rpm

Now check that mpm-itk has been installed.
httpd.itk -l

Compiled in modules:
core.c
prefork.c
http_core.c
mod_so.c

In order for the httpd service to use the mpm you need to make a few changes as its disabled by default. First of all edit httpd.conf and add the following lines.
# itk modules

AssignUserID apache apache
StartServers 8
MinSpareServers 5
MaxSpareServers 20
ServerLimit 256
MaxClients 256
MaxRequestsPerChild 4000

Then edit /etc/sysconfig/httpd and add this line
HTTPD=/usr/sbin/httpd.itk

Restart apache and you should notice all the processes are httpd.itk now

Attachments

httpd-223-11itk3i386.rpm httpd-devel-223-11itk3i386.rpm httpd-manual-223-11itk3i386.rpm mod_ssl-223-11itk3i386.rpm httpd-itk.spec httpd.spec.diff

Tags: apache, centos, mpm-itk

This entry was posted on Saturday, July 12th, 2008 at 2:21 pm and is filed under Development. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.