Running cgi and module at the same time

Hello, My main need war enabling PHP for users and the main webmaster. There's only one Web server. I wanted to run secure users' PHP scripts (like it it's been with C, Perl, sh scrips for years) and try to enable the module PHP for the webmaster (for performance and features). I run PHP-3.0.12 CGI and 4.0B2 module version at the same time on the same server (Apache 1.3.9). I'd like to have advices about this setup: is it fine, safe ?. Do you have scripts to test the security (I tested uploads, .htaccess overrides, system()) of a PHP setup ? PHP-3.0.12 is compiled as CGI with the following compilation options : ./configure --with-config-file-path=/etc/httpd/conf \ --enable-discard-path \ --enable-safe-mode PHP-4.0B2 cgi does not compile yet on my system, the current CVS does ; as soon as PHP-4.0B3 is out, I'll replace this, and the conf file will be moved to /etc/httpd/conf/php_cgi in order not to mix the two conf files needed. PHP-4.0B2 is compiled as module with the following compiltaion options : ./configure --with-config-file-path=/etc/httpd/conf \ --with-apache=../apache_1.3.9 Apache 1.3.9 compiled as follows : ./configure --sbindir=/etc/httpd/sbin \ --prefix=/etc/httpd \ --enable-suexec \ --enable-module=digest \ --suexec-safepath="/bin:/usr/bin:/bin/php:/web/b in:/web/bin/error" \ --suexec-logfile=/etc/httpd/logs/cgi.log \ --suexec-caller=~ \ --suexec-userdir=www \ --suexec-docroot=/web \ --suexec-uidmin=100 \ --suexec-gidmin=100 \ --activate-module=src/modules/php4/libphp4.a CGI scripts are handled by suEXEC, so PHP scripts are handled this way to for users. They have to mention #!/space/www/bin/php/php at the beginning of their scripts. For more convenience, I added : AddHandler cgi-script .cgi .php .php3 so users can reuse php scripts a little more easily. These scripts run with their uid/gid via suEXEC and the cgi php runs in safe_mode. The scripts handled by the module must have a .phtml extension : AddType application/x-httpd-php .phtml By default, the module php has its engine disabled, it's only re-enabled in httpd.conf for the DocumentRoot Directory with : <Directory "/web"> Options [deleted] php_flag engine on </Directory> This is used ot prevent users having phtml files to be run under Apache owner identity. Users won't be able to re-enable the php engine for phtml files via a local .htaccess. I set the following in httpd.conf : <Directory /u> Options [deleted] AllowOverride AuthConfig Limit </Directory> What do you think of such a setup ? Is it safe ? Is there a better way to do this (maybe via mod_rewrite) ? Thanks for your comments, it's the only solution I have found so far. -- Olivier Cahagne snina@ambafrance.org olivier.cahagne@epita.fr Tel: (613) 593 7406 Ambassade de France au Canada Service Culturel 464, Wilbrod St. K1N 6M8, Ottawa, Ontario, Canada