UPDATE: I have included a script to change permissions for all the websites hosted in Plesk in order to make the installation easier

Today I had to install suPHP on a MediaTemple Dedicated-Virtual (dv) server with Plesk.  The main reason why I had to do this was because we were migrating a site from Bluehost hosting services to GoDaddy (And they FAIL, like always). We configured our customer new VPS (Which GoDaddy provisioned in two or three  days, which is VERY SLOW for any VPS hosting company – this normally takes from 5 minutes to 2 hours MAX), but that isn’t the worst point. After we configured the server that came with cPanel (We used cPanel’s EasyApache script) to update PHP + Apache + Installing suPHP + other tweaks, we migrated the website from Bluehost to this GoDaddy server but we were getting a warning on the cPanel install that it was a Trial Version (Our customer bought a license) so our customer contacted GoDaddy Support and they said that we have to re-provision the server since the cPanel license wasn’t applied :/

So we had to move the site over to our server which was running cPanel too (This is really easy using Transfer feature in cPanel) and then re-provisioned the customer server, but since this will take another 48-72 hours our customer decided to rent a VPS in MediaTemple (Which offered Plesk instead of cPanel, I personally prefer cPanel because it allows you to tweak the software running on your server like installing Suhosin, suPHP, upgrading PHP/Apache, etc) so we had to migrate the site AGAIN from our server to MediaTemple Dedicated-Virtual (dv) server.

Finally the site was running in MediaTemple server, the site uses WordPress Bloggin software and since Plesk doesn’t come with suPHP a lot of issues popped up, some of them were:

- Problems with image uploads in the Admin backend
- Problems removing plugins
- Problems when editing customized theme
- Etc

So we needed to install suPHP to mitigate all of this issues without chmodding *.* to 777 WHICH IS A VERY BAD THING (Consider yourself warned!).

But since Plesk doesn’t come with suPHP by default we had to install it from source, so here is the process:

Prerequisites:

- SSH Root Access to your MediaTemple server
- Install Development Tools

In your MediaTemple WebControl you have to click on:

Root Access & Developer Tools
Enable root access and install development tools.

Then after you installed your Development Tools (Will take 5 to 10 minutes) I recommend you to install the Yum Package Manger since MediaTemple Dedicated-Virtual (dv) server doesn’t come with it:

rpm -Uvh http://mirror.centos.org/centos/5/os/i386/CentOS/python-iniparse-0.2.3-4.el5.noarch.rpm

rpm -Uvh http://mirror.centos.org/centos/5/os/i386/CentOS/yum-3.2.22-26.el5.centos.noarch.rpm http://mirror.centos.org/centos/5/os/i386/CentOS/yum-fastestmirror-1.1.16-14.el5.centos.1.noarch.rpm

Now download the last version of suPHP (Which in this moment is 0.71):

wget http://www.suphp.org/download/suphp-0.7.1.tar.gz

tar -zxvf suphp-0.7.1.tar.gz

cd suphp-0.7.1

./configure --with-apxs=/usr/sbin/apxs --with-php=/usr/bin/php-cgi --with-logfile=/var/log/suphp.log --with-min-uid=30 --with-min-gid=30 --with-apache-user=apache --with-apr=/usr/bin/apr-1-config --with-setid-mode=owner --prefix=/usr --sysconfdir=/etc

make

make install

cd /etc/httpd/conf.d/

Create a new file called suphp.conf with this content:

LoadModule suphp_module modules/mod_suphp.so

<Directory /var/www/vhosts>
php_admin_value engine off
suPHP_Engine On
AddHandler x-httpd-php .php .php3 .php4 .php5
suPHP_AddHandler x-httpd-php
</Directory>

Now we have to create the configuration file for suPHP located at  /etc/suphp.conf with the following content:

[global]
;Path to logfile
logfile=/var/log/suphp.log

;Loglevel
loglevel=none

;User Apache is running as
webserver_user=apache

;Path all scripts have to be in
docroot=/var/www/vhosts

; Security options
allow_file_group_writeable=false
allow_file_others_writeable=false
allow_directory_group_writeable=false
allow_directory_others_writeable=false

;Check wheter script is within DOCUMENT_ROOT
check_vhost_docroot=false

;Send minor error messages to browser
errors_to_browser=false

;PATH environment variable
env_path=/bin:/usr/bin

;Umask to set, specify in octal notation
umask=0022

; Minimum UID
min_uid=30

; Minimum GID
min_gid=30

[handlers]
;Handler for php-scripts
x-httpd-php="php:/usr/bin/php-cgi"
;Handler for CGI-scripts
x-suphp-cgi="execute:!self"

Now we backup the actual Apache configuration:

cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf.bkp

And now we have to comment the following lines in the file /etc/httpd/conf/httpd.conf (In my file are the last lines):

AddType application/x-httpd-php .php
AddType application/x-httpd-php-source .phps

Now you have to change the file permissions to 0644 for files and 755 for directories. Let’s go to the website directory:

cd /var/www/vhosts/<DOMAIN>/httpdocs/

Note: <DOMAIN> is the website you want to change permissions to

And now we will execute the following command to change the file and directories permissions, change file ownership and restart the Apache service:

find . -type f -exec chmod 644 {} \;; find . -type d -exec chmod 755 {} \;; find . -exec chown <USER>:psacln {} \;; service httpd restart

Note: <USER> is the system user for the domain

UPDATE:

If you want to do this automatically for all users hosting their website in your server you can run the following script instead of the above long command:

#!/bin/bash

while IFS=':' read -r login pass uid gid uname homedir comment; do

if [[ "$homedir" = **/var/www/vhosts/** ]]; then

if [ -d "$homedir/httpdocs" ]; then

find $homedir/httpdocs -type f -exec chmod 644 {} \;;

find $homedir/httpdocs -type d -exec chmod 755 {} \;;

find $homedir/httpdocs -exec chown $login:psacln {} \;

fi

fi

done < /etc/passwd

service httpd restart

You should check if in your httpdocs directory exists a php.ini file since this will be loaded as your default PHP configuration file so check that this file is correct.

I hope that this guide helps you to run your websites securely in your Plesk server.

Thank you for reading!