note 40369 added to security.apache

There is a safe way to support a lot of users in a secure way, without having to use CGI, in a way which is probebly faster than mod_php. Use FastCGI, with the SuExecWrapper set to your suid wrapper. It means every user wil get his own program-group, with processes which are being reused. If the numer of processes that is being started on startup is 0, then the processgroup for a user will be generated when needed. This means: The first page is slow, after that the Zend Engine caching kicks in. When the load on the virtualhost reduces, the processes wil die off, and extra processes for a user-process-group will only be started when (again) needed. Your apache will be a LOT! lichter, because it won't have to drag all the php-memory overhead with it. This means static content is faster, and the whole system uses less memory. The PHP itself also won't need to drag along the apache overhead. If for one reason or the other php craches, your apache will simple start some new php-processes. If you want to upgrade/patch php, you can simple create the new fastcgi binary, and after testing, you can simple update the system by copying it, and maybe doing a 'apachectl gracefull' In short : Sepparating distinct functions in different processes communicating useing IPC methodes can be very good for performance and security. The best example of this principle at work is Postfix, where every process runs chroot() under its own uid. http://wiki.openisis.org/i/view/Php/HowtoFastCgi ---- Manual Page -- http://www.php.net/manual/en/security.apache.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+40369 Delete -- http://master.php.net/manage/user-notes.php?action=delete+40369&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+40369&report=yes Search -- http://master.php.net/manage/user-notes.php