使用非Apache用户在非Apache端口上运行PHP应用程序

Question

We have a PHP application which automates script commands. Many of these are through web interfaces. I want this php application user to be running lots of cli and ssh commands, so I dont really want www-data doing it, as it would involve changing lots of script files to www-data executable permissions, and we want scripts to be entered into web interfaces.

This application is cross-operating system. Ideally on anything that php runs on, but win, mac,

The important things that we need to be able to do are (I think) ...

1) Have a Web Server (It's currently Apache, and that's working cross os so that would be great), that is running under normal settings, normal user, reverse proxied to the below application on te same server. 2) Have a PHP application on a different port, running as its own user that can do whatever it wants.

The ability to just run

php -S localhost:8000

As is available in the built in php web server seems ideal for this. So...

1) Is it safe to use the PHP built in Web Server if it's behind an apache proxy? I'm assuming the fact we are proxying over the entire request anyway means no, since it says not to.

2) Is there another Web Server/PHP Server that can easily do this?

3) Is there a way of running two apache processes to do this?

4) Am i doing this the wrong way entirely? There's another app I know that does it like that, but a Java app and the whole process is started and owned by a non apache user.

Thanks in advance

Answer 1

Apache 2.4 + php-fpm + mod_proxy_fcgi will suit you just fine.

(to elaborate for the downvote -- php-fpm allows the PHP process to run as a separate daemon under its own userid which is exactly the privilege separation requested here)