I am trying to setup a web server running Apache + mod_fcgid + mod_security chroot enabled and having a real hard time to get this working. Apache was installed from official CentOS repo and mod_fcgid and mod_security were installed from EPEL repo.
At first, I even was unable to start Apache while chroot is enabled but I've fixed lots of stuff but there's still some I need to sort out.
First problem, when I try to start Apache while it's stopped, it does start with no problems, however, when I try to restart it while running this is what I get;
$ service httpd restart
Stopping httpd: [FAILED]
Starting httpd: (98)Address already in use: make_sock: could not bind to address [::]:80
(98)Address already in use: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs
[FAILED]
Apache Error Log;
[Mon Jun 17 07:47:51 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Mon Jun 17 07:47:52 2013] [notice] ModSecurity: chroot checkpoint #1 (pid=954 ppid=953)
[Mon Jun 17 07:47:52 2013] [notice] ModSecurity for Apache/2.7.3 (http://www.modsecurity.org/) configured.
[Mon Jun 17 07:47:52 2013] [notice] ModSecurity: APR compiled version="1.3.9"; loaded version="1.3.9"
[Mon Jun 17 07:47:52 2013] [notice] ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"
[Mon Jun 17 07:47:52 2013] [notice] ModSecurity: LUA compiled version="Lua 5.1"
[Mon Jun 17 07:47:52 2013] [notice] ModSecurity: LIBXML compiled version="2.7.6"
[Mon Jun 17 07:47:52 2013] [notice] Digest: generating secret for digest authentication ...
[Mon Jun 17 07:47:52 2013] [notice] Digest: done
[Mon Jun 17 07:47:53 2013] [notice] ModSecurity: chroot checkpoint #2 (pid=955 ppid=1)
[Mon Jun 17 07:47:53 2013] [notice] ModSecurity: chroot successful, path=/var/www
[Mon Jun 17 07:47:53 2013] [notice] Apache/2.2.15 (Unix) DAV/2 mod_fcgid/2.3.7 configured -- resuming normal operations
The second problem is that regular HTML files are being served with no problems but PHP pages are not.
mod_security logs;
--98586c48-A--
[17/Jun/2013:08:01:37 --0400] Ub76oUJVtI0AAAPEDiYAAAAG CLIENT_IP_GOES_HERE 51722 SERVER_IP_GOES_HERE 80
--98586c48-B--
GET /testphp.php HTTP/1.1
Host: hostname
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-gb,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=5a9jqak7dt30l2vvrs9c74lo81
Connection: keep-alive
Cache-Control: max-age=0
--98586c48-F--
HTTP/1.1 500 Internal Server Error
Content-Length: 543
Connection: close
Content-Type: text/html; charset=iso-8859-1
--98586c48-E--
--98586c48-H--
Apache-Error: [file "fcgid_proc_unix.c"] [line 637] [level 4] [status 104] mod_fcgid: error reading data from FastCGI server
Apache-Error: [file "/builddir/build/BUILD/httpd-2.2.15/server/util_script.c"] [line 435] [level 19] Premature end of script headers: testphp.php
Apache-Handler: fcgid-script
Stopwatch: 1371470497629709 2809 (- - -)
Stopwatch2: 1371470497629709 2809; combined=25, p1=3, p2=10, p3=1, p4=1, p5=9, sr=0, sw=1, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.7.3 (http://www.modsecurity.org/).
Server: Apache
Engine-Mode: "ENABLED"
--98586c48-Z--
Where I'm wrong at? What I'm missing?