mpm-itk allow you to run Apache VirtualHost under a specific user/group instead of under the Apache user/group. On Debian/Ubuntu Apache web server is run under user www-data. When you host multiple websites under an Apache server, running all sites under the same www-data user allows a hacker to access files of other sites if one of the sites is hacked. Having apache VirtualHost run as it own user give user-level isolation for each of your website. This also avoids permission-related errors due to apache running as a different user than the user you use to upload the files.
mpm-itk is non-threaded, it works file with mod_php. It works very similarly to mod_ruid2, which is removed from the latest Debian due to a security issue.
On Debian/Ubuntu, you can install it with
apt install libapache2-mpm-itk
During the installation, the apache module gets enabled by default, you can enable/disable it with command
a2dismod mpm_itk a2enmod mpm_itk
To activate mpm-itk, all you need to do is add the following code to the Apache VirtualHost entry of your website.
AssignUserID USERNAME GROUP
I normally create a user with the command
useradd -m --shell /bin/bash --home /home/DOMAIN_NAME USERNAME
Then create a VirtualHost like the following
vi /etc/apache2/sites-available/DOMAIN_NAME.conf
Add
ServerName DOMAIN_NAME
ServerAlias www.DOMAIN_NAME
ServerAdmin info@DOMAIN_NAME
DocumentRoot /home/DOMAIN_NAME/html
CustomLog ${APACHE_LOG_DIR}/DOMAIN_NAME.log combined
ErrorLog ${APACHE_LOG_DIR}/DOMAIN_NAME-error.log
Header always append X-Frame-Options SAMEORIGIN
AssignUserID USERNAME USERNAME
Options All -Indexes
AllowOverride All
Require all granted
Order allow,deny
allow from all
Enable VirtialHost with
a2ensite DOMAIN_NAME
Create website folders
mkdir /home/DOMAIN_NAME/html/ chown -R USERNAME:USERNAME /home/DOMAIN_NAME/ chmod -R 755 /home/DOMAIN_NAME/
Restart Apache webserver
systemctl restart apache2
