note 108939 deleted from function.session-set-save-handler by cmb

Note Submitter: Cloudranger ---- Ever since we upgraded to PHP 5.3 we have had issues with session storage using files. Regularly when session garbage collection was triggered, permissions errors would be thrown. This is due to the fact that garbage collection is triggered by visitors to a website based on the session.gc_probability and session.gc_divisor settings which factor the chance of garbage collection running. As these processes are owned by Apache but the directory in which the files reside is owned and readable only by root, the Apache processes clearly cannot list the files in the session directory to work out what to delete. Changing the ownership and permissions on the directory is a no-no for security reasons, which leaves you with the option of turning off PHP based garbage collection and writing your own, or moving away from using files. For some reason, when we turned off garbage (session.gc_probability = 0) the garbage collection still ran anyway, so we decided to move away from files. The initial approach which most people on php.net seem to take is to write a custom session handler class in PHP using MySQL, which is not a bad approach as you can use a memory based MySQL table to gain performance. However it requires you to write code, and also to modify your website to put in the session handler override code. If you have lots of website to change this is out of the question. The simplest solution we found, which in the end took about 2 minutes in total, and immediately worked for all websites on the server, was to use sqlite. Some PHP installations already have SQLite installed and when you run php -i on the command line it shows sqlite as a "Registered save handler". If sqlite is not installed as a registered save handler, you need to install it. On CentOS/RHEL this was simply a case of the following command: yum install php-sqlite. Once done, check the registered save handlers again with the php -i command. Once sqlite shows as a registered save handler, you simply have to edit your php.ini file to change the following two settings: OLD VALUES: session.save_handler = files session.save_path = /var/lib/php/session NEW VALUES: session.save_handler = sqlite session.save_path = /path/to/directory/containing/sqllite/database/phpsession.sdb The path above and the name of the database are entirely configurable by you. PHP will create the database itself, but the directory must exist and be accessible. Once you have made these changes, simply bounce Apache with apachectl graceful or apachectl restart Note that any users on your server will have their sessions reset.