Converting DSO to SuPHP ...

[Spiral]

One of my most common requests is a script to handle system changes needed when converting to SuPHP and though such an automation script has been a part of our toolbox at My Server Expert for a long time, here is a variation of it for the rest of you ....

http://www.myserverexpert.com/build/dso2su.sh

Background:
-----------------------------------------------------------------------------
Though converting from DSO (Apache Module) based PHP to SuPHP is easy to do with EasyApache, this only changes the PHP platform on the system and doesn't address the possibly thousands of permissions, ownerships, and .htaccess files you have to edit to get SuPHP working with your existing accounts which may already be full of disallowed items such as scripts with the owner set to "nobody", script files or folders set to 777, or .htaccess files trying to set PHP configuration overrides. If you don't get rid of these items, scripts will fail or the sites will throw Error 500 after converting over to SuPHP as your new PHP platform. This script helps avoid that problem!

Converting to SuPHP (Basic Rundown):

1. Use EasyApache to setup SuPHP

2. Set PHP Config to PHP 5, SuPHP, SuExec

3. Run the script given above ...

# wget http://www.myserverexpert.com/build/dso2su.sh
# chmod 700 ./dso2su.sh
# ./dso2su.sh

4. Check your /var/log/messages log to see if there are any user
accounts requiring special handling or a custom PHP.INI file

That's it! You should be up and running on SuPHP!


No warranties are made or implied. Use the above script at your own risk!

[ManojB]

Thanks Spiral for great script, I will be soon using this on one of the server.

[tvcnet]

Likewise.
Thank you very much for the script concept and discussion.

I see your web site and new hosting vision is still in it's, ah, building phase...

Need any help, I may be able to get you up and running at no cost - just as thank you.

More than an enough client's to go around. Competition doesn't bother us.

Best Wishes,
Jim
TVC.Net

[Spiral]

I see your web site and new hosting vision is still in it's, ah, building phase...

Need any help, I may be able to get you up and running at no cost - just as thank you.

Jim:

Actually our site was up for a long time and then about 3 weeks ago, we radically changed our entire product and service line up adding on a whole new catalog of servers and services as well as simultaneously changing both our billing and support systems and then one week later, yet another set of new services was deployed so everything is a little bit of a mess at the moment web site wise and still playing catch up getting the information added to the site and the new backend links setup which the past few weeks has been non-stop revisions but things now are finally settling down and getting back to a more normal pace and new price lists have been finalized.

Our internal development crew is already working quickly on the above; However, if you think you might be able to do something better, I'd consider letting you take a stab at it

More than an enough client's to go around. Competition doesn't bother us.

Maybe not so much as you think! Our primary market is actually hosting providers themselves.

While we do have servers and various managed and monitoring services, our primary business
first and foremost is deep security analysis and server hardening and most of our clients are
actually web hosts that against our server offerings would be technically competition I suppose
but nobody really ever seems to really care just so long as they get me personally (biggest request)
for handling their server setups. (what can I say, I'm popular )

[cpanelkenneth]

The script that Spiral is providing (http://www.myserverexpert.com/build/dso2su.sh ) is vulnerable to the same root exploit issue(s) reported by Jeff in this thread: http://forums.cpanel.net/f6/scripts-...em-132985.html

[tvcnet]

Hi,
The script seems to function well, though I encountered something when running it on a test server set up.

Oddly, the .htaccess and phi.ini subroutines work nicely, but I found after running it, at least one account still had lots of 777 set files and directories, as though it script skipped right over them.

Ref:
## Fix Folders with BAD Permissions ##
## Fix PHP Scripts with BAD Permissions ##


Which leads me to the next question, it seems the next step in developing this script would be to log all the files/directories updated?

Has anyone else noticed permissions not updated after execution?


Many thanks,
Jim

[Spiral]

Oddly, the .htaccess and phi.ini subroutines work nicely, but I found after running it, at least one account still had lots of 777 set files and directories, as though it script skipped right over them.

This version of the script is designed to skip unusual problem it can't recognize in this simplified form of the script. If something is "wrong" with the account requiring manual attention, it will simply leave the account in place.

Also, it doesn't target all "777" files, just those that are PHP scripts. Other files may still be set to 777.

Which leads me to the next question, it seems the next step in developing this script would be to log all the files/directories updated?

As for "developing" the script or "adding logging", my response to those statements would be to laugh hysterically at and spit my coffee all over the monitor

(The script published on Cpanel is actually a small subset of the script I actually use which in the full verstion already has all of those things and much, much more including logging, handling unusual accounts, automatically creating custom PHP.INI configurations and adapting previous overrides, extended notifications, verifying accounts functioning, seeking out actual system errors and fixing them, etc )

[Spiral]

If anyone had problems downloading "dso2su.sh" this past weekend, my apologies!


I forgot that there was links to that script here a Cpanel forums and had moved the file to another location during website updates and re-organizing this weekend. The script is now moved back to it's original web address.

[nocbr.com]

Someone knows what the problem with this script and how to solve it ?

I have 700 accounts in a server and I would like to convert to phpsuexec, a script like this would be very helpfull.

Thanks.

[tvcnet]

Hi. This is an old discussion on the subject and the script needed a good bit of massaging to fully work, at least for us and the dozen or so servers we updated to suPHP last year.

I may be able to assist offline. Please feel free to send me a private message on this.

[cPanelTristan]

Hello,

I think rather than using a script, it's better to know the steps that you need to run and run those commands. This way, if anything goes wrong, you know what you is being done for that specific step. Also, having someone else perform the task for you then doesn't allow you to know for any future servers how to do the switch, not to step on anyone's toes for offers to help.

I have a guide where I provided steps in the past (it's my non-staff account when I made the post):

Switching to suPHP

If you have questions on it, please feel free to ask. I suggest tailing the error log for Apache if any sites aren't working following the steps for conversion as well as picking a time when the server will not be overly active to allow sufficient time for the switch. To tail the log, you'd simply do:

tail -f /usr/local/apache/logs/error_log

To see any sites that might have issues after the switch has been completed.

Thanks.