# SuPHP Sessions Folder

**URL:** <https://forums.interworx.com/t/suphp-sessions-folder/13085>\
**Category:** Feature Requests\
**Created:** [February 9, 2012, 8:59am UTC](https://forums.interworx.com/t/suphp-sessions-folder/13085 "2012-02-09T08:59:29Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![domaineplus](https://forums.interworx.com/letter_avatar_proxy/v4/letter/d/a5b964/32.png) [@domaineplus](https://forums.interworx.com/u/domaineplus)\
**Post date:** [February 9, 2012, 8:59am UTC](https://forums.interworx.com/t/suphp-sessions-folder/13085/1 "2012-02-09T08:59:29Z")

</div>

Hi,

```
Issue: We currently use the SuPHP configuration for many reasons and since the default session folder (/var/lib/php/session) is in root:apache 770 permissions, no site can write to this folder. (if I am missing something here, please tell me, hehe, I'd love to know how to fix this)

Suggestion: It would be nice that when the server is in SuPHP mode that all new sites be created with a session folder and session configuration (in the site specific php.ini) that points to something like /home/username/session and that this folder has normal site user permissions (siteusr:sitegrp 750 or something similar).

Hope this is understandable! :)

```

Thanks!

---

<div class="post-metadata">

**Author:** ![zombie\_process](https://forums.interworx.com/letter_avatar_proxy/v4/letter/z/7ab992/32.png) [@zombie\_process](https://forums.interworx.com/u/zombie_process)\
**Post date:** [February 9, 2012, 5:02pm UTC](https://forums.interworx.com/t/suphp-sessions-folder/13085/2 "2012-02-09T17:02:38Z")

</div>

I just have a cron script run every 5 min to chmod the sessions folder 333. Hackish, but it works.

---

<div class="post-metadata">

**Author:** ![domaineplus](https://forums.interworx.com/letter_avatar_proxy/v4/letter/d/a5b964/32.png) [@domaineplus](https://forums.interworx.com/u/domaineplus)\
**Post date:** [February 10, 2012, 7:06am UTC](https://forums.interworx.com/t/suphp-sessions-folder/13085/3 "2012-02-10T07:06:24Z")

</div>

I do something similar for the moment but my concerns are more about security and customization…

Moreover, it would be nice a that an empty etc/php.ini be created for every new site under SuPHP with a comment mentionning something like:

; Add your php.ini directives here and they will override the default server config only for your site…

---

<div class="post-metadata">

**Author:** ![zombie\_process](https://forums.interworx.com/letter_avatar_proxy/v4/letter/z/7ab992/32.png) [@zombie\_process](https://forums.interworx.com/u/zombie_process)\
**Post date:** [February 10, 2012, 3:24pm UTC](https://forums.interworx.com/t/suphp-sessions-folder/13085/4 "2012-02-10T15:24:09Z")

</div>

I agree completely. I was just offering what I’ve done as a workaround so that I don’t end up with broken sessions every time there’s an upgrade.

---

<div class="post-metadata">

**Author:** ![domaineplus](https://forums.interworx.com/letter_avatar_proxy/v4/letter/d/a5b964/32.png) [@domaineplus](https://forums.interworx.com/u/domaineplus)\
**Post date:** [February 13, 2012, 7:14am UTC](https://forums.interworx.com/t/suphp-sessions-folder/13085/5 "2012-02-13T07:14:35Z")

</div>

No problem ZombieProcess! Your replies are appreciated even if we already have something similar in place. If we did not have anything like this, it would’ve helped so it’s always a good thing to reply even for simple things. 🙂

---

<div class="post-metadata">

**Author:** ![IWorx-Dan](https://forums.interworx.com/letter_avatar_proxy/v4/letter/i/d2c977/32.png) [@IWorx-Dan](https://forums.interworx.com/u/IWorx-Dan)\
**Post date:** [February 13, 2012, 9:17am UTC](https://forums.interworx.com/t/suphp-sessions-folder/13085/6 "2012-02-13T09:17:48Z")

</div>

Most of the time we see hosts set session.save\_path in their php.ini to /var/tmp or /tmp to put session data. Since session files are created as owner/group of the siteworx user in mode 600, that would reasonably obstruct someone who compromised one account from spying on the session data of another. This is probably preferred over setting crons to repeatedly chmod the folder.

The suPHP integration is something we are looking into improving so this suggestion is something we can factor into our decision process.

---

<div class="post-metadata">

**Author:** ![domaineplus](https://forums.interworx.com/letter_avatar_proxy/v4/letter/d/a5b964/32.png) [@domaineplus](https://forums.interworx.com/u/domaineplus)\
**Post date:** [February 13, 2012, 10:21am UTC](https://forums.interworx.com/t/suphp-sessions-folder/13085/7 "2012-02-13T10:21:45Z")

</div>

Excellent Dan!

Thank you for your response and desire to improve suPHP integration with Interworx. That will be greatly appreciated.