This section looks at some other installation issues you may
encounter.
3.11.1. How Do I Make the Installation More Secure?
Unix systems
usually provide
chroot or jail mechanisms,
which allow you to run subsystems isolated from the main system. So
if a subsystem gets compromised, the whole system is still safe.
Section 23.3.5 includes a few
references to articles discussing these mechanisms.
3.11.2. Can I Run mod_perl-Enabled Apache as suExec?
The answer is definitively
"no." You can't
suid a part of a process. mod_perl lives inside
the Apache process, so its UID and GID are the same as those of the
Apache process.
You have to use mod_cgi if you need this functionality. See Appendix C for other possible solutions.
3.11.3. Should I Rebuild mod_perl if I Have Upgraded Perl?
Yes, you
should. You have to rebuild the mod_perl-enabled server, because it
has a hardcoded @INC variable. This points to the
old Perl and is probably linked to an old libperl
library. If for some reason you need to keep the old Perl version
around, you can modify @INC in the startup script,
but it is better to build afresh to save you from getting into a
mess.
3.11.4. mod_auth_dbm Nuances
If
you are a
mod_auth_dbm
or
mod_auth_db
user, you may need to edit Perl's
Config module. When Perl is configured, it
attempts to find libraries for ndbm,
gdbm, db, etc. for the
DB*_File modules. By default, these libraries are
linked with Perl and remembered by the Config.pm
module. When mod_perl is configured with Apache, the
ExtUtils::Embed module requires these libraries to
be linked with httpd so Perl extensions will
work under mod_perl. However, the order in which these libraries are
stored in Config.pm may confuse
mod_auth_db*. If mod_auth_db*
does not work with mod_perl, take a look at the order with the
following command:
panic% perl -V:libs
Here's an example:
libs='-lnet -lnsl_s -lgdbm -lndbm -ldb -ldld -lm -lc -lndir -lcrypt';
If -lgdbm or -ldb is before
-lndbm (as it is in the example), edit
Config.pm and move -lgdbm and
-ldb to the end of the list.
Here's how to find Config.pm:
panic% perl -MConfig -e 'print "$Config{archlibexp}/Config.pm\n"'
Under Solaris, another solution for building mod_perl- and
mod_auth_dbm-enabled Apache is to remove the DBM and NDBM
"emulation" from
libgdbm.a. It seems that Solaris already
provides its own DBM and NDBM, and in our installation we found
there's no reason to build GDBM with them.
In our Makefile for GDBM, we changed:
OBJS = $(DBM_OF) $(NDBM_OF) $(GDBM_OF)
to:
OBJS = $(GDBM_OF)
Then rebuild libgdbm before building
mod_perl-enabled Apache.
