Permissions of webserver's root directory

Question

I've had this issue on several setups, and I'm unsure of how to handle it.

At first, all of /var is owned by root:root. Clearly I don't want the web directory to be owned by root, so I do chown apache:apache /var/www. However, when someone is ssh'd in as root, if they do something like an svn update or edit a file, it's going to change the ownership back to root.

Is there any way to fix this? I've heard of using something with suPhp, but I'm unsure if it's necessary.

Answer 1

Note: In your case, the best would be to just drop root privileges for updates and run your scripts with your apache user:

 su apache -c "./update-script"

---

Otherwise, use chmod g+s /var/www. New files and sub-directories created inside this directory will share the same owner/group as the parent directory, by default. (This spreads recursively.)

According to the coreutils manual this is a GNU-ish extension which is not portable. This seems to work only for the group id, but I think it should be enough to deal with this general kind of issue. (Using umask 002 when running the script might help also.)

Answer 2

Clearly I don't want the web directory to be owned by root

Why? What is your security model?

chown apache:apache /var/www

WTF is your security model!!!????

when someone is ssh'd in as root

Aaaarrggghhhh!

Stephane G's answer makes a lot of sense if you DO NOT USE the apache user. For most security models, a more sensible approach is to set up a group of users to have write access to the files and set the group ownership and group sticky, execute and write bit on directories, then allow the webserver uid access as 'other'. If you must have specific directories/files writeable by the webserver uid, then set the user on these to the webserver uid (but keep the same group as elsewhere).

And you should never allow root ssh logins (a AllowGroups/AllowUsers whitelist is far better than denying specific users/PermitRootLogin=no)