0

I've been using Ubuntu Linux for a couple years now but I still have trouble with permissions.

I need to setup my web server for production. The root web directory should always be accessible by Apache and me (I login to ftp with my account) as well (if possible) by my CGI applications. I would like to hear your ideas of the best way to set something up like this in production.

Maybe what I've suggested isn't the best way to set this up even. If there's a better way to set things up for production (I plan to be using CGI scripts and compiled CGI binaries)

2
  • When you say accessible, do you really mean "writable"?
    – jordanm
    Commented Jan 8, 2014 at 4:01
  • Yes, reading and writing.
    – APott
    Commented Jan 8, 2014 at 4:11

2 Answers 2

1

The directory should be owned and writable by the user making updates/changes to the web content. This should not be the Apache run-as user (by default, www-data).

So then:

  • Neither user nor group ownership should be www-data.
  • Normal files should be mode 644 or 664.
  • Executable files and directories should be 755 or 775.
  • If the Apache user must write to a directory for some reason (i.e., an upload script) that one directory should be mode 1777.

Remember, Apache will be performing actions on behalf of unknown and untrusted remote users. So only permit Apache to do what you want to let everyone on Reddit do on your box.

3
  • So every time I place a file in the directory I have to edit the permissions to my chosing? Thanks for the answer btw
    – APott
    Commented Jan 8, 2014 at 4:51
  • No, you should set your UMASK appropriately so they get the permissions automatically when created.
    – bahamat
    Commented Jan 8, 2014 at 4:52
  • Hi, @bahamat, I've been comparing answers about webserver permissions across various SE sites (SO, SF, AskUbuntu, Webmasters) and just trying to understand differences in opinions / facts. Would you mind elaborating on why the apache user, i.e. www-data, should not own (or group-own) the web content? Many models I've read actually advocate that so as to revoke world-read permissions, but I'd like to hear the counterargument if there is one! Commented May 1, 2014 at 13:45
0

You can also use apache2-mpm-itk which allows to customize Apache user and group used for each virtual host.

apt-get install apache2-mpm-itk

nano /etc/apache2/sites-available/mydomain.com

<VirtualHost *:80>
    ServerAdmin [email protected]
    ServerName mydomain.com
    ServerAlias www.mydomain.com
    DocumentRoot /home/myuser/mydomain.com
    Options -Indexes
    AssignUserID myuser mygroup
</VirtualHost>

See Create and set up an Apache virtual host for more details.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .