CGI vs Module

[jjpetrucelli]

Im not finding any information that can lead me to the difference between installing PHP as CGI or a Module. I have info, it just hasnt been enough for me to understand. I am not familiar with the effects of the differences. I am transforming a site from CF to PHP and I know that within the CF there are some CGI scripts. The website I am working on is about 100% dynamic and will utilize the PHP. Can anyone give me some more info, suggestions, or point me in the right direction for info? Please let me know if I am not clear of if you have any questions to clarify my situation.

 

[ericbrunson]

Module is usually less resource intensive because it does not require the expense of an 'exec()' call and uses a little less memory for subsequent calls.

CGI can be made more secure in some environments because the php script can run under different user permissions than the web server.

 

[ingresman]

Some things work differently e.g. you have to use the module to do http authentication.
I wonder if anyone knows why ?, i thought it was all to do with headers

 

[ericbrunson]

That sounds strange to me. If you require .htaccess in your, it should require authentication.

Yep, I just tried it and it worked. You can't htaccess protect a ScriptAlias directory, but you can put your scripts in a normal directory, require authentication in instruct apache to dispatch the script based on extension.

 

[ingresman]

mmmm my source must be wrong !, i'll try to find it !

 

[ingresman]

this is one source

http://www.zend.com/zend/tut/authentication.php#Heading4

 

[ericbrunson]

I see what you're saying. PHP can intercept the Auth Handler of apache. You are right, you can't override the Auth Handler except in a module, you can still protect your CGIs using an auth handler that *is* installed.

 

[jjpetrucelli]

ericbrunson or anyone ~ the pro's of both mod and cgi sound interesting, of course both speed and security are of major interest. Can you give me an example of a scenario of when the php script can run under different user permissions than the web server? Im trying to figure out if i can go with the module for speed (less resources) while not negotiating any security...

 

[ericbrunson]

The simplest form is with suEXEC:

http://httpd.apache.org/docs-2.0/suexec.html

Other options are using SELinux, which you can read about at

http://www.nsa.gov/selinux/index.cfm,

but it is *way* beyond the scope of this forum.

 

[jjpetrucelli]

i like this quote from the linked page;

"If you aren't familiar with managing setuid root programs and the security issues they present, we highly recommend that you not consider using suEXEC."

I think that was written specifically for me, so it sounds like I want php as a module?