lighttpd forum lighty > FastCGI PHP: individual users without write access?

Posted by Guido Schmidt
on 14.05.2008 11:36
Hi all,

I started configuring my server following 
http://trac.lighttpd.net/trac/wiki/HowToSetupFastCgiIndividualPermissions.

When I set USERID to the appropriate user I can fire startup.sh and it 
creates a socket in /var/www/fastcgi/user and spawns a new php-cgi 
process.

Now I'd like to improve security by changing USERID to 'nobody' so the 
php processes don't have write access to the user's files (according to 
the HowTo). But that prevents startup.sh from creating/accessing the 
socket file. It says:

  spawn-fcgi.c.127: bind failed: Permission denied

when there's no socket file,

  spawn-fcgi.c.127: bind failed: Address already in use

when there is a socket file, created by startup.sh with USERID set to 
user, e.g.

  srwxrwx--- 1 gts gts  0 2008-05-14 12:00 gts.socket

How can I give the php-cgi process access to the socket file without 
compromising security?

Thanks for any help.
Guido