CloudLinux Documentation

mod_hostinglimits works with existing CGI/PHP modules, to put them into LVE context. In most cases the CGI/PHP process will be placed into LVE with the ID of the user that sites belongs to. mod_hostinglimits detects the user from SuexecUserGroup (suexec module), SuPHP_UserGroup (from mod_suphp), AssignUserID (MPM ITK), RUidGid (mod_ruid2) directives.

 

This can be overwritten via LVEId or LVEUser parameter on the Directory level. Note that those parameters will not work with mod_fcgid and mod_cgid. The order of detection looks as follows:

 

·         LVEId

·        LVEUser

·        SuexecUserGroup

•suPHP_UserGroup

·        RUidGid

·        AssignUserID

 

 

Note. LVE doesn't work for mod_include #include due to its "filter" nature.

 

 

Example:

LoadModule hostinglimits_module modules/mod_hostinglimits.so
<IfModule mod_hostinglimits.c>
 AllowedHandlers cgi-script php5-script php4-script
 SecureLinks On
</IfModule>

 

Additional notes

 

mod_hostinglimits (since version 1.0-22) supports min-uid - cagefsctl --set-min-uid=600. Min UID is read on Apache start/restart and stored in the memory during apache runtime. If min UID has changed, you should restart Apache for mod_hostinglimits applying new min UID value. Full min UID is supported only with APR.

 

The following message should appear: [notice] mod_hostinglimits: found apr extention version 3. This means that the correct APR is installed with mod_hostinglimits.

 

mod_hostinglimist has variable for Apache CustomLog format string - %{LVE_ID}y. How to use:

 

LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i" req for lve %{LVE_ID}y" combined

 

shows in access_log the following info:

 

*.*.*.* - - [09/Apr/2015:07:17:06 -0400] "GET /1.php HTTP/1.1" 200 43435 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Firefox/24.0" req for lve 500

*.*.*.* - - [09/Apr/2015:07:17:06 -0400] "GET /1.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42 HTTP/1.1" 200 2524 "************/1.php""Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Firefox/24.0" req for lve 500

*.*.*.* - - [09/Apr/2015:07:17:06 -0400] "GET /1.php?=PHPE9568F35-D428-11d2-A769-00AA001ACF42 HTTP/1.1" 200 2146 "************/1.php""Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Firefox/24.0" req for lve 500

 

Installation

 

 

 

Directives

 

SecureLinks

 

 

Prevents apache from serving files not owned by user, stopping symlink attacks against php config files.

 

Example:  

SecureLinks On

SkipErrors

 

 

Prevents Apache from exiting if LVE is not available.

 

Example:

SkipErrors Off

AllowedHandlers

 

 

This directive allows to list handlers which will be intercepted and placed into LVE.

 

Example:

 

Match requests handled by cgi-script handler:

AllowedHandlers cgi-script

Match all requests:

AllowedHandlers *

Match all requests that handled by handler that contains PHP:

AllowedHandlers %php%

Match all requests handled by handler that starts with PHP:

AllowedHandlers %^php%

DenyHandlers

 

 

This directive works together with AllowHandlers, to exclude some handlers from being allowed in LVE.

 

Example:

 

Match all requests, but text/*

AllowedHandlers *
DenyHandler %text/*%

LVEErrorCode

 

 

Specifies ErrorCode to use on LVE error (like too many concurrent processes running). The message that will be displayed by default is:

Resource Limit Is Reached
The website is temporarily unable to server your request as it exceeded resource limit.
Please try again later.
You can redefine error message using ErrorDocument directive

Example:

LVEErrorCode 508
ErrorDocument 508 508.html

LVEid

 

 

Specifies LVE id for particular directory

 

Example:

<Directory "/home/user1/domain.com/forums">
 LVEId 10001
</Directory>

LVEUser

 

 

Specifies LVE ID for particular directory.

 

Example:

<Directory "/home/user1/domain.com/forums">
       LVEUser user1
</Directory>

LVEUserGroupID

 

 

If the option enabled, group ID will be used instead of a user ID. Apache will display the following string in error logs:  

mod_hostinglimits: use GroupID instead of UID
mod_hostinglimits: found apr extension version 2
mod_hostinglimits: apr_lve_environment_init_group check ok

If a compatible apr library is not found, the following error message will be display in error logs.

mod_hostinglimits:  apr_lve_* not found!!!

Example:

<Directory "/home/user1/domain.com/forums">
       LVEUserGroupID On
</Directory>

LVERetryAfter

 

 

Specifies interval for Retry-After header.  The Retry-After response-header field can be used to indicate how long the service is expected to be unavailable to the requesting client.

 

Example:  

LVERetryAfter 180

LVESitesDebug

 

 

Specifies virtual hosts to provide extra debugging information.

 

Example:

<Directory "/home/user1/domain.com/forums">
       LVESitesDebug abc.com yx.cnet
</Directory>

LVEParseMode

 

 

In CONF mode, standard way to extract LVE ID is used (SuexecUserGroup, LVEId, or similar directives).

 

In PATH mode, username is extracted from the home directory path. The default way to match username is via the following regexp: /home/([^/]*)/. Custom regexp can be specified in LVEPathRegexp.

 

In OWNER mode, the owner of the file is used as an LVE ID.

 

In REDIS mode, LVE ID is retrieved from Redis database.

 

Example:  

 

LVEParseMode CONF

 

 

LVEPathRegexp

 

 

Used to extract usersname via path.

 

Example:  

LVEPathRegexp /home/([^/]*)/

LVELimitRecheckTimeout

 

 

Example:  

LVELimitRecheckTimeout 1000

LVEUse429

 

 

Example:

LVEUse429 on

Available for RPM based panels, EasyApache 4 and DirectAdmin.