Running Vhosts Under Separate UIDs/GIDs

Install apache2-mpm-itk

apache2-mpm-itk is available as a Debian package for Debian Etch, so all we have to do is run.

apt-get install apache2-mpm-itk

Configuring apache2-mpm-itk

apache2-mpm-itk is configured on a per-vhost basis, i.e., we don’t have to set any global options, and there’s only one directive we need to set in a vhost, AssignUserId, which takes two parameters, the user name and the group that the vhost will run as.

In this example I will use the default Debian Apache vhost (you can find its configuration in /etc/apache2/sites-available/default) with the document root /var/www (if you have different vhosts, please adjust this to your situation), and I want this vhost to run as the user web1_admin and group web1.

If the user and group don’t already exist, we can create them as follows:

groupadd www-group
useradd -s /bin/false -d /home/www_home -m -g web-group www-user

Then we open our vhost configuration and add the following lines to it:

[...]

<IfModule mpm_itk_module>
AssignUserId www-user www-group
</IfModule>

[...]

Restart Apache afterwards:

/etc/init.d/apache2 restart