1

I am trying to transplant an instance of RT 4.0.1 (with local code customization) from a CentOS 4 server to a CentOS 6 server.

My problem appears to be that I can't get the fastcgi script to start.

When apache starts, it gives this error:

[Mon Mar 25 12:37:37 2013] [warn] FastCGI: server "/opt/rt4/sbin/rt-server.fcgi" (uid 48, gid 48) restarted (pid 1504) suexec policy violation: see suexec log for more details
[Mon Mar 25 12:37:37 2013] [warn] FastCGI: server "/opt/rt4/sbin/rt-server.fcgi" (pid 1504) terminated by calling exit with status '107'
[Mon Mar 25 12:37:38 2013] [warn] FastCGI: server "/opt/rt4/sbin/rt-server.fcgi" has failed to remain running for 30 seconds given 3 attempts, its restart interval has been backed off to 600 seconds

The contents of suexec.log:

[2013-03-25 12:37:37]: uid: (apache/apache) gid: (apache/apache) cmd: rt-server.fcgi
[2013-03-25 12:37:37]: cannot run as forbidden uid (48/rt-server.fcgi)

The suexec.log implies I need to either

  • tell suexec it is permitted to run the fastcgi script as apache (which is what seems to be happening on the C4 system); or
  • figure out how tell suexec to run the fastcgi script as a different user

My google-fu is weak today, I cannot find an answer to either question.

The contents of the site definition:

FastCgiServer /opt/rt4/sbin/rt-server.fcgi -processes 5 -idle-timeout 180

<VirtualHost *:80>
ServerName arrtee.$MYDOMAIN

   AddDefaultCharset UTF-8

   # Pass through requests to display images
   Alias /NoAuth/images/ /opt/rt4/share/html/NoAuth/images/
   ScriptAlias / /opt/rt4/sbin/rt-server.fcgi/

   DocumentRoot "/opt/rt4/share/html"
   <Location />
        Order allow,deny
        Allow from all

        Options +ExecCGI
        AddHandler fastcgi-script fcgi
   </Location>
</VirtualHost>

I can run the fastgcgi-script as root, and it works. (After which point I change the ownership and groupmembership on the entire /opt/rt4 tree back to apache:apache.)

I've even removed the whole /opt/rt4 tree and tried to re-install from source, and that it still doesn't work.

Can someone tell me what I'm missing here?

MadHatter
  • 78,442
  • 20
  • 178
  • 229
David Mackintosh
  • 14,223
  • 6
  • 46
  • 77

2 Answers2

1

You don't mention how you installed fastcgi, but there is note in the web deployment docs that some distributions also need:

FastCgiIpcDir /tmp

Many users have also had luck with mod_fcgid, which is available as a package via EPEL.

SELinux settings can also sometimes cause permission problems and require special settings if you want to leave it fully enabled.

Jim Brandt
  • 280
  • 1
  • 4
  • In my case, the fastcgi was the default load with CentOS 6. And I did mess around with the FastCgiIpcDir setting thinking that was the permissions problem. – David Mackintosh Apr 04 '13 at 15:37
0

There's no cure for a problem like asking a quesiton in a public forum.

In my case, on the CentOS 6 server, there is a directive in /etc/httpd/conf.d/fastcgi.conf:

# wrap all fastcgi script calls in suexec
FastCgiWrapper On

Comment out the second line, and it works, presumably by disabling the suexec security. Which in the long run is probably the wrong solution to the problem.

David Mackintosh
  • 14,223
  • 6
  • 46
  • 77