I wouldn’t recommend this for all sites – mod_php is much more efficient – but in my case there was one site in particular that was very low traffic but where security was very important.

Directory structure

This is the directory structure I’m using, so you can visualise it:

/etc/
    apache2/
        sites-enabled/
            test.conf         <-- Apache site configuration
/home/
    sites/
        test/
            cgi-bin
                php.fcgi    <-- FastCGI wrapper script
            conf/
                php.ini       <-- PHP configuration
            htdocs/
                phpinfo.php   <-- Test script

How to install

Install & enable FastCGI and suEXEC

sudo apt-get install php5-cgi libapache2-mod-fastcgi apache2-suexec-custom
sudo a2enmod actions fastcgi suexec
sudo /etc/init.d/apache2 restart

Configure suEXEC

sudo vim /etc/apache2/suexec/www-data

Replace the first line with the parent directory of all websites:

/home/sites

Comment out or delete the second line if you aren’t using UserDir.

Create a FastCGI wrapper script

Note that permissions are important here – suEXEC will refuse to run if the file is group-writable.

mkdir /home/sites/test/cgi-bin/
chmod 755 /home/sites/test/cgi-bin/
vim /home/sites/test/cgi-bin/php.fcgi

#!/bin/sh
export PHP_FCGI_CHILDREN=4
export PHP_FCGI_MAX_REQUESTS=200
export PHPRC="/home/sites/test/conf/php.ini"
exec /usr/bin/php5-cgi

chmod 755 /home/sites/test/cgi-bin/php.fcgi
sudo chown -R dave:dave /home/sites/test/cgi-bin/

Set the site to use FastCGI

vim /etc/apache2/sites-enabled/test.conf

    ...

    # Use FastCGI version of PHP
    php_admin_flag engine off
    ScriptAlias /cgi-bin /home/sites/test/cgi-bin
    Action application/x-httpd-php /cgi-bin/php.fcgi
    SuexecUserGroup dave dave

Restart Apache

sudo /etc/init.d/apache2 restart

Protect the web files from other users

Now you can set it so only the suEXEC user can read the PHP files.

Note: The directories and non-PHP files must still be readable by Apache.

sudo chown -R dave:dave /home/sites/test/htdocs/
find /home/sites/test/htdocs/ -name '*.php' -exec sudo chmod o-rwx '{}' \;
find /home/sites/test/htdocs/ -name '*.inc' -exec sudo chmod o-rwx '{}' \;

Notes

1. Make sure the php.fcgi script is saved in Unix line-ending format not Windows – otherwise, again, FastCGI will hang for 30 seconds then time out. Test the script by running it at the command line.

2. If you make any changes to the wrapper script (php.fcgi), you must kill the existing instances before you will see the changes. (I did this by restarting Apache, but I suspect there is a more graceful way!)

3. You do not have to make the PHP scripts executable, or add the shebang to the top – it is the wrapper script that is executed, not the PHP scripts.

4. If it doesn’t load correctly check the suEXEC log:

sudo tail /var/log/apache2/suexec.log

To do this you’ll need root access to the server – reseller or normal user access will not do. You also need to be comfortable using the command line and editing configuration files.

Warnings

• You won’t be able to use the Ruby on Rails section in cPanel – everything will have to be done using the command line instead.
• If you mess up the Apache configuration you could break your web server – so make sure you know what you’re doing!
• This is what worked for me – there may be better solutions I’m not aware of.

What we’re going to install

Ruby Version Manager makes it easy to install multiple versions of Ruby into your home directory. We’ll use that to install Ruby 1.9 separately from the cPanel-provided version 1.8.

Phusion Passenger (a.k.a. mod_rails) is an Apache module that lets you run multiple Rails apps under a single Apache instance – no need for backend servers like Mongrel any more.

Install RVM, Ruby & Phusion Passenger

1. Create a new user

First you need to decide which user to install it under. It’s probably best not to do it as root (I don’t even know if it would let you), so I created a new user especially for this. That way I know I won’t accidentally break it.

To do that, go to WebHost Manager (WHM) > Account Functions > Create a New Account. I used the username ruby and the domain name ruby.myservername.com (using my actual server name of course).

2. Install RVM

Now log in as that user via SSH and install RVM:

bash < <(curl -s https://raw.github.com/wayneeseguin/rvm/master/binscripts/rvm-installer)

If it tells you to install some dependancies, log in as root and do that. In my case it told me to run this:

yum install -y gcc-c++ patch readline readline-devel zlib zlib-devel libyaml-devel libffi-devel openssl-devel make bzip2 autoconf automake libtool bison iconv-devel

Now (back as the ruby user) load RVM:

source "$HOME/.rvm/scripts/rvm"

You should also configure Bash to load RVM automatically at login:

echo '[[ -s "$HOME/.rvm/scripts/rvm" ]] && source "$HOME/.rvm/scripts/rvm"' >> ~/.bashrc

3. Install Ruby

Now it’s time to install Ruby. I installed version 1.9.2 because I couldn’t get ruby-debug to work with the latest version, 1.9.3.

rvm install 1.9.2
rvm --default 1.9.2

4. Install Bundler

You’ll also need Bundler installed, so let’s install it now:

gem install bundler

This is the only Rails gem you need to install under this user account – the rest can be installed locally for each app.

5. Install Phusion Passenger

gem install passenger
passenger-install-apache2-module

Passenger will give you some code to add to your Apache config – make a note of it.

Now log in as root again and add that code to /usr/local/apache/conf/includes/pre_main_global.conf. e.g. My code was:

LoadModule passenger_module /home/ruby/.rvm/gems/ruby-1.9.2-p290/gems/passenger-3.0.11/ext/apache2/mod_passenger.so
PassengerRoot /home/ruby/.rvm/gems/ruby-1.9.2-p290/gems/passenger-3.0.11
PassengerRuby /home/ruby/.rvm/wrappers/ruby-1.9.2-p290/ruby

Now tell cPanel to rebuild the main Apache config file:

cp /usr/local/apache/conf/httpd.conf /usr/local/apache/conf/httpd.conf.bak-modrails
/usr/local/cpanel/bin/apache_conf_distiller --update
/scripts/rebuildhttpdconf
/etc/init.d/httpd restart

6. Make sure all the RVM files are world-readable

As the ruby user again:

chmod ugo+x ~
chmod ugo+rX -R ~/.rvm

That’s it – you’re ready to run Rails! The next section shows how to set up each app.

Using Ruby on Rails

Installing RVM, Ruby and Ruby on Rails

You will need to install RVM, Ruby and Ruby on Rails for each user that will be creating Rails apps. The commands are the same as we used above:

bash < <(curl -s https://raw.github.com/wayneeseguin/rvm/master/binscripts/rvm-installer)
source "$HOME/.rvm/scripts/rvm"
echo '[[ -s "$HOME/.rvm/scripts/rvm" ]] && source "$HOME/.rvm/scripts/rvm"' >> ~/.bashrc
rvm install 1.9.2
rvm --default 1.9.2
gem install rails

Creating a new Rails app

Nothing special here:

rails new hello_world

For the following examples I’ll assume your app is installed in ~/hello_world.

Installing Gems to the vendor/ directory

If you run bundle, that will install the Gems to your RVM directory, which won’t be picked up by Passenger. There’s instructions on the RVM website how to make that work, but I wasn’t able to make it work.

A much simpler solution is to install the Gems to the vendor/ directory, where they are picked up automatically:

bundle install --deployment

Or if you are using the site for development not production:

bundle install --path vendor/bundle

Bundler will remember the path after that, so you can just run bundle install (or even just bundle) as normal.

Installing Rails to a subdirectory

e.g. http://example.com/hello/

The simplest way to make the new Rails app accessible is to make a symlink from a subdirectory to the Rails public/ directory:

ln -s ~/hello_world/public ~/public_html/hello

Passenger will automatically detect the symlink and load Rails for you.

Installing Rails to a subdomain / add-on domain

e.g. http://hello.example.com/

The second way is to create a subdomain or add-on domain for the app. You can do this in cPanel – just set the document root to hello_world/public. Again, Passenger will do the rest.

Installing Rails to the site root

e.g. http://example.com/

The Phusion Passenger documentation tells you to set the Apache DocumentRoot to the Rails public/ directory… But cPanel doesn’t let you do that!

Instead we have to remove the existing ~/public_html/ folder and symlink it to the Rails public/ directory instead:

mv public_html public_html-backup
ln -s hello_world/public public_html

But then Passenger fails to find the Rails root, so we have to set it manually in the hello_world/public/.htaccess file:

PassengerAppRoot /home/myusername/hello_world

Other tips

Using the production environment automatically

You will probably want to use the production environment instead of the development one. To make that the default for all commands, simply set the RAILS_ENV environment variable:

export RAILS_ENV=production

To set it automatically when you log in:

echo "export RAILS_ENV=production" >> ~/.bashrc

Precompiling the assets

Since this is a production site you will need to precompile the assets:

rake assets:precompile

Restarting the app

The final thing I had to do after making all those changes is restart the app:

touch tmp/restart.txt

This tells Passenger to restart the app next time you visit it, and saves you having to restart Apache every time.

Sources

• RVM documentation
• cPanel Admin Blog
• Phusion Passenger users guide
• And many others I’ve forgotten about!

sudo mkdir /etc/sambapasswords
sudo chmod 700 /etc/sambapasswords

Now create a file for the server itself:

sudo vim /etc/sambapasswords/myserver

Enter the credentials in this format:

username=windowsusername
password=mypassword

(Note: The maximum password length is 16 characters. I spent ages trying to debug it when I was using a randomly generated 20 character password!)

And make sure the file itself is secure, just in case:

sudo chmod 600 /etc/sambapasswords/myserver

Create the directory where it should be mounted:

sudo mkdir /mnt/myserverfiles

Now edit /etc/fstab:

sudo vim /etc/fstab

And add the following line:

//myserver/path/to/files /mnt/myserverfiles smbfs credentials=/etc/sambapasswords/myserver 0 0

Finally tell it to mount the newly added share now (so you don’t have to reboot to test it / start using it):

sudo mount -a

openssl genrsa -out server.key 1024

(If you’re concerned about security you should also look at the -des3 and -rand options – see here – otherwise I’ve found this works fine for testing.)

2. Generate a certificate signing request

openssl req -new -key server.key -out server.csr

Answer the questions when prompted – e.g.

• Country Name: UK
• State or Province Name: England
• Locality Name: blank
• Organization Name: DaveJamesMiller.com
• Organizational Unit Name: blank
• Common Name: secure.davejamesmiller.com (Enter the domain name)
• Email Address: me@example.com

The only one that really matters for a self-signed certificate is the Common Name field, which should be set to the domain name.

3. Self-sign the certificate

openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

This will be valid for 365 days, but you could increase that if you want to.

4. Configure Apache

This will depend on how your distro is set up, but it will look something like this:

<VirtualHost *:443>
ServerName secure.davejamesmiller.com
DocumentRoot /var/www/secure/
SSLEngine on
SSLCertificateFile /path/to/server.crt
SSLCertificateKeyFile /path/to/server.key
</VirtualHost>

If you want to say exactly the same thing as the original author, retweeting makes it very easy.

But sometimes wouldn’t it be better to rewrite the tweet in your own words – to tell your followers why you think something is worth reading, or to add your own opinion?

For example, I recently retweeted:

@holman: Updated my “How GitHub Uses GitHub to Build GitHub” slides for #rubymidwest. http://zachholman.com/talk/how-github-uses-github-to-build-github Videos will be coming soon.

Which gives you an idea of what it’s about, and Zach’s reason for posting it, but doesn’t tell you why I thought it was worth sharing.

What I should have said instead is:

How GitHub uses GitHub to collaborate asynchronously and avoid meetings & meta-work http://zachholman.com/talk/how-github-uses-github-to-build-github by @holman

Note that I still credit the original author – in this case with “by @holman” since he wrote the post too, but if he didn’t I’d write “via @holman” instead.

In the future I’m going to make more of an effort to do that.

Install FreeTDS and the PHP MS SQL extension

sudo apt-get install freetds-common freetds-bin unixodbc php5-sybase

Note: That is correct, the MS SQL extension is in the “php5-sybase” package.

Restart Apache

sudo /etc/init.d/apache2 restart

Test FreeTDS

tsql -H your.server.name -p 1433 -U yourusername -P yourpassword -D yourdatabasename

If it connects, it’s working.

Note: If you try to SELECT an NTEXT or NVARCHAR column you may get an error saying “Unicode data in a Unicode-only collation or ntext data cannot be sent to clients using DB-Library (such as ISQL) or ODBC version 3.7 or earlier”. That is expected and will be fixed in the next step.

Configure FreeTDS

sudo vim /etc/freetds/freetds.conf

Add this at the end of the file:

[yourserver]
host = your.server.name
port = 1433
tds version = 8.0

Test FreeTDS using server name

tsql -S yourserver -U yourusername -P yourpassword -D yourdatabasename

If you try to select something, you shouldn’t get the Unicode error now – because you specified “tds version = 8.0″.

Test in PHP

<?php
$link = mssql_connect('yourserver', 'yourusername', 'yourpassword');

if (!$link) {
   die('Unable to connect!');
}

if (!mssql_select_db('yourdatabasename', $link)) {
   die('Unable to select database!');
}

$result = mssql_query('SELECT * FROM yourtable');

while ($row = mssql_fetch_array($result)) {
   var_dump($row);
}

mssql_free_result($result);
?>

Rather than permanently downgrade PHP for the whole server, I opted to install PHP 5.2 alongside it using FastCGI. It took some trial-and-error to get it to compile with all the features I need, but here is how I did it:

Directory structure

This is the directory structure (at the end), so you can visualise it:

/etc/
    apache2/
        sites-enabled/
            test.conf         <-- Apache site configuration
/opt/
    php52/
        bin/
            php-cgi           <-- PHP CGI binary
            ...
        ...
/home/
    sites/
        test/
            cgi-bin
                php52.fcgi    <-- FastCGI wrapper script
            conf/
                php.ini       <-- PHP configuration
            htdocs/
                phpinfo.php   <-- Test script

How to install

Install & enable FastCGI

sudo apt-get install libapache2-mod-fastcgi
sudo a2enmod actions fastcgi
sudo /etc/init.d/apache2 restart

Download PHP

 mkdir ~/php5-build
cd ~/php5-build
wget http://uk3.php.net/get/php-5.2.17.tar.bz2/from/this/mirror -O php-5.2.17.tar.bz2
tar jxf php-5.2.17.tar.bz2
cd php-5.2.17/

Download dependancies

sudo apt-get build-dep php5
sudo apt-get install libfcgi-dev libmhash-dev

Compile PHP

./configure \
    --prefix=/opt/php52 \
    --enable-force-cgi-redirect \
    --enable-fastcgi \
    --with-regex=php \
    --enable-calendar \
    --enable-sysvsem \
    --enable-sysvshm \
    --enable-sysvmsg \
    --enable-bcmath \
    --with-bz2 \
    --enable-ctype \
    --with-iconv \
    --enable-exif \
    --enable-ftp \
    --with-gettext \
    --enable-mbstring \
    --with-pcre-regex \
    --enable-shmop \
    --enable-sockets \
    --enable-wddx \
    --with-libxml-dir=/usr \
    --with-zlib \
    --with-openssl=/usr \
    --enable-soap \
    --enable-zip \
    --with-mhash=yes \
    --with-gd \
    --with-mysql \
    --with-mysqli \
    --with-pdo-mysql \
    --with-pear \
    --with-jpeg-dir=/usr/lib \
    --enable-gd-native-ttf \
    --with-ttf \
    --with-freetype-dir=/usr
make
sudo make install
sudo chmod o+rX -R /opt/php52/

Create a FastCGI wrapper script

mkdir /home/sites/test/cgi-bin/
chmod o+rX /home/sites/test/cgi-bin/
vim /home/sites/test/cgi-bin/php52.fcgi

#!/bin/sh
export PHP_FCGI_CHILDREN=4
export PHP_FCGI_MAX_REQUESTS=200
export PHPRC="/home/sites/test/conf/php.ini"
exec /opt/php52/bin/php-cgi

chmod a+rx /home/sites/test/cgi-bin/php52.fcgi

Set the site to use FastCGI

vim /etc/apache2/sites-enabled/test.conf

<VirtualHost *>

    ...

    # Use FastCGI version of PHP
    php_admin_flag engine off
    ScriptAlias /cgi-bin /home/sites/test/cgi-bin
    Action application/x-httpd-php /cgi-bin/php52.fcgi

</VirtualHost>

Restart Apache

sudo /etc/init.d/apache2 restart

Notes

It took me many hours to get this right. Here are some of the things I learned:

1. If you don’t have libfcgi-dev installed when you compile PHP, it will compile fine, but FastCGI will time out when you try to use it.

2. Make sure the php52.fcgi script is saved in Unix line-ending format not Windows – otherwise, again, FastCGI will hang for 30 seconds then time out. Test the script by running it at the command line.

3. If you miss out the --with-jpeg-dir=/usr/lib switch the first time, you must run make clean before PHP will compile a second time with JPEG support.

4. If you make any changes to the wrapper script (php52.fcgi), you must kill the existing instances before you will see the changes. (I did this by restarting Apache, but I suspect there is a more graceful way!)

5. You do not have to make the PHP scripts executable, or add the shebang to the top – it is the wrapper script that is executed, not the PHP scripts.

• Beyond Compare – Synchronise local and remote files
• Color Cop – Colour picker
• gVim (with various customisations) – Powerful text editor
• JRuler – Measure on-screen distances
• PuTTY – SSH client
• WinSCP – FTP/SFTP/SCP client

Firefox plugins

• Clear Cache Button – Quickly clear the cache
• Clear DNS Cache – Quickly clear the DNS cache
• Firebug – Very powerful tool for development and debugging
• Firecookie – View site cookies in Firebug
• FirePHP – Display server-side messages from PHP in Firebug
• HTML Validator – Validate (X)HTML
• Open With – Quickly open a page in other web browsers
• Server Switcher – Quickly switch between development & production server
• Wappalyzer – See what software powers every website
• Web Developer – More tools for web development
• WorldIP – See the IP/hostname of every website
• YSlow – Test the speed of your websites

Browsers for testing

• Firefox
• Google Chrome
• IETester
• Internet Explorer
• Opera
• Safari