Changes between Version 6 and Version 7 of ApacheSuexec

Timestamp:

Jun 10, 2005, 5:11:58 PM (19 years ago)

Author:

mjs at clemson.edu

Comment:

Added instructions for multiple projects, suExec, and RHEL 4.

ApacheSuexec

@@ -112 +112 @@
 
 ----
+
+== Multiple Projects, suExec, and RHEL 4 ==
+'''Added by mjs at clemson.edu'''
+
+Here's what I learned trying to follow the above instructions on a vanilla RHEL4 installation.  I'll attempt to clarify some points that I found confusing and some important RHEL-specific issues.
+
+My layout is as follows:
+
+ * Project Trac installations are in /home/tracker/Trac/Projects/project-a /home/tracker/Trac/Projects/project-b, etc.
+ * The Trac site is a separate vhost from our other Web pages.
+ * The Trac site lives in /home/tracker/Trac/htdocs/.
+ * /home/tracker/Trac/cgi-bin is a symlink to /var/www/cgi-bin/tracker/ (see below).
+ * URLs are !http://trac.example.com/projects/project-a, etc.
+
+Red Hat compiles suExec so that it only executes CGI scripts that live below /var/www.  You cannot symlink individual scripts, but you can symlink a directory.  This means that we can't drop CGI scripts under doc root.  The scripts will have to live in the cgi-bin subdirectory.  Scripts must also not be group-writable.
+
+The Trac vhost is defined as follows:
+{{{
+<VirtualHost *:80>
+    ServerAdmin webmaster@example.com
+    DocumentRoot /home/tracker/Trac/htdocs
+    ServerName trac.example.com
+
+    RewriteEngine on
+    RewriteRule ^/projects/+$               /projects/index.html  [L]
+    RewriteCond /home/tracker/Trac/Projects/$1  -d
+    RewriteRule ^/projects/([^/]+)(/?.*)    /cgi-bin/tracwrap.cgi$2 [S=1,PT]
+    RewriteRule ^/projects/(.*)             /projects/index.html
+
+    ScriptAlias /cgi-bin/ "/home/tracker/Trac/cgi-bin/"
+    SuexecUserGroup coin coin
+    ErrorLog /var/log/trac/error_log
+    CustomLog /var/log/trac/access_log combined
+    Alias /icons /home/tracker/Trac/htdocs/icons
+</VirtualHost>
+}}}
+Notes:
+ * The !ScriptAlias line enables CGI script invocation in the named subdirectory.  This subdirectory must be a symlink to a directory under /var/www/cgi-bin/.
+ * The second !RewriteRule finds the project name and appends anything following it to the rewritten URL.  Normally, the result of a !RewriteRule is appended to the path to doc root.  The PT ("Pass Through") flag prevents this, so /cgi-bin/tracwrap.cgi is invoked as a script.
+ * The E flag in torgny's example is superfluous, as suExec strips it from the environment anyway.
+
+As above, the tracwrap.cgi script sets environment variables for trac.cgi depending on the project name:
+{{{
+
+#!/bin/bash
+proj=${SCRIPT_URL#/projects/}
+project=${proj%${PATH_INFO}}
+export TRAC_ENV="/home/tracker/Trac/Projects/${project}"
+export SCRIPT_NAME="/projects/${project}"
+exec ./trac.cgi
+}}}
+I found that the variables you need to manipulate are quite different than in torgny's example.  SCRIPT_URL contains the entire local URL, e.g., "/projects/project-a/login" and PATH_INFO already contains anything after the project name.  So to get the project name, you need to strip "/project/" off the front of ${SCRIPT_URL} and "${PATH_INFO}" off the end.  On entry, SCRIPT_NAME contains "tracwrap.cgi", not anything related to the project name.
+
+
+----
 See also: TracInstall, TracMultipleProjects