EXAMPLE DELIMA

Example configuration of how to combine the
security and restrictions of SuExec with the
power and speed of mod_perl.

For example, here is the delima:

There are three webmasters on this unix
machine:

  billy
  henry
  ralph

We want hits to billy.com to be run as billy.
We want hits to henry.com to be run as henry.
We want hits to ralph.com to be run as ralph.

They all want to take advantage of mod_perl
features like PerlHandlers or Apache::Registry
scripts, but all point to the same IP address:

  10.11.12.13

All users wish to keep their sources private
among themselves, so they remove all permissions
for group and other for their home directories.

[root@localhost /root]# chmod 0700 /home/*
[root@localhost /root]# ls -ald /home/*
drwx------  4 billy  billy  4096 Apr 02 12:00 /home/billy
drwx------  4 henry  henry  4096 Apr 02 12:00 /home/henry
drwx------  4 ralph  ralph  4096 Apr 02 12:00 /home/ralph
[root@localhost /root]#

Each user is responsible to turn on his own server
and listen on his own designated port as follows:

  billy.com   =>  8001
  henry.com   =>  8002
  ralph.com   =>  8003

USER PROCEDURE

Each user will have his own server and configuration
files.  In Apache, this is done using the -f option.
Each configuration file will contain the Listen
directive with its corresponding port.  Also, mod_perl
must be enabled to utilize the Apache::DNAT feature.

[billy@localhost billy]$ tail ~/conf/httpd.conf
# Don't use the Port directive
#Port 80

# Listen: Allows you to bind Apache to specific IP addresses and/or ports
Listen 8001

<IfModule mod_perl.c>
  PerlModule Apache::DNAT
  PerlInitHandler Apache::DNAT
</IfModule>
[billy@localhost billy]$ httpd -f ~/conf/httpd.conf
[billy@localhost billy]$

(The same goes for the other users, too.)

No <VirtualHost> sections should be used.  No special
User directive or SuExec configuration is required.

ADMIN PROCEDURE

As super user, turn on this DNAT server:

[root@localhost /root]# suexec_mod_perl.pl --log_level=4

And to turn it off:

[root@localhost /root]# kill `cat /var/log/dnat/dnat.pid`

SEE ALSO

apache, mod_perl, Net::DNAT, Apache::DNAT