Re: [Sheflug] Web Server document permissions

["Chris J" <cej [at] xxxxxxxxxxxxxxxx>]

And Lo! The Great Prophet Ashe uttered these words of wisdom:
> 
> On my server, the web directory (/var/www/html) is owned by root and under 
> root group, which means that any time I want to alter the webpages, I have to
> create everything, upload it somewhere else, then su into root and copy 
> across, which seems like a very cumbersome way of going about it. Are there 
> any ways that this can be stepped around without it being too insecure?
> 

I tend to have two users for web stuff, and one group:

	wwwrun and wwwadmin - wwwrun used by webserver (a non-login account)
		and wwwadmin owns the directories for the DocumentRoot (i.e.,
		in your case /var/www/html)

and the group:
	wwwrun - which is the group that Apache runs as, and also is the
		group the directories under DocumentRoot are owned by.

This way, I have a dedicated account for the webserver, seperate from 
nobody, root, users etc, and can lock DocumentRoot down to permissions 
o-rwx (i.e., webserver needs gorup read permissions).

So in httpd.conf,
	User	wwwrun
	Group	wwwrun

and for document root (taking your directory):
	chown -R wwwadmin:wwwrun /var/www/html
	chmod -R o-rwx /var/www/html

and that locks it down quite nicely. You could use whatever owner you want 
for DocumentRoot - I tend to like to put a seperate one aside, then scp in 
as that user to copy stuff (scp files wwwadmin [at] remoteserver:/var/www/html)

Alternatively, you could do this:

	chown -R wwwadmin:wwwadmin /var/www/html
	chmod -R g+rwx,o+rx /var/www/html

and create a group wwwadmin. Then, anyone that needs to write to /var/www/
html just needs to be in the wwwadmin group. The webserver runs as group 
wwwrun, so you need to have global-read permissions on the directories and 
files at and under /var/www/html.

Any help?

Chris...

-- 
\ Chris Johnson                 \ NP: Inkubus Sukkubus - 01. Supernature
 \ cej [at] nightwolf.org.uk          \  
  \ http://cej.nightwolf.org.uk/  \ 
   \ http://redclaw.org.uk/        ~---------------------------------------



___________________________________________________________________

Sheffield Linux User's Group -
http://www.sheflug.co.uk/mailfaq.html

  GNU the choice of a complete generation.