What is best practice for using suEXEC on complex sites?

We've got a site running under a single vhost, and we want to be able to run different PHP web apps eg /forum /wiki /crm as their own UIDs, to help isolate any potential security threats.

I've used apache2 + mod_fastcgi + mod_suexec to split multiple sites to unique UIDs by vhost before. However, mod_suexec's SuexecUserGroup directive only works inside a <VirtualHost> block, and is not valid in a more specific <Directory> or <Location>

Is changing to lighttpd + suexec the only way to achieve this level of isolation without resorting to using a rewrite/proxy hack?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.