1

I'm setting up an Apache2/Ubuntu web server and I'm stuck as to how to achieve the security settings I need.

On the www folder - the web root - my www-data group (the apache and PHP account) needs to have limited permissions to prevent any scripts running under Apache from modifying or deleting files without explicit permission. However, users who connect using WinSCP or similar to transfer their files into the www folder need to have full permissions so that they can copy files into the web root and remove old files etc.

Ideally, I would seem to need one group - www-data - with limited permissions for the webserver to operate under and one group - say "webdevelopers" to contain any people working on web projects - with full permissions on the www folder.

Those of you who set up web servers regularly - can advise me how you secure your web root correctly while allowing developers to add and remove files as they need?

  • So you want the www folder to be only editable by a specific group users? – tachomi Sep 25 '14 at 15:53
3

Your apache and PHP scripts should be running under the same user.

One idea you might come up with (This is garethTheRed's idea) is to create a www-devs group which contains your developers, change the ownership of /www-data to apache:www-devs, and set the mode to 0570.
This will result in the web server able to read from the directory, but not write to it. Members of the www-devs group will be able to write. However this has a major issue, new files that are added by your developers will by owned by the developers. Apache will be neither the owner of these files, nor in the group owning them. Thus apache won't be able to read them.

The best solution is to use filesystem ACLs. You can use ACLs to add multiple different groups with different permissions. You can also set new files to inherit these permissions.

groupadd www-devs
setfacl -R -d -m g:www-devs:rwX -m g:www:r-X /www-data
setfacl -R -m g:www-devs:rwX -m g:www:r-X /www-data

The first setfacl line sets up the default permissions for any new files that get created. The second setfacl line sets up the permissions on the existing files.

The permissions end up looking like this:

$ getfacl --all-effective /www-data 
getfacl: Removing leading '/' from absolute path names
# file: www-data
# owner: apache
# group: www
user::r-x
group::r-x          #effective:r-x
group:www:r-x           #effective:r-x
group:www-devs:rwx      #effective:rwx
mask::rwx
other::---
default:user::rwx
default:group::rwx      #effective:rwx
default:group:www:r-x       #effective:r-x
default:group:www-devs:rwx  #effective:rwx
default:mask::rwx
default:other::rwx

This shows us that the www group only has read & execute permissions, while www-dev has read write & execute.

Lets try creating a file:

$ touch /www-data/foo
$ getfacl --all-effective /www-data/foo
getfacl: Removing leading '/' from absolute path names
# file: www-data/foo
# owner: root
# group: root
user::rw-
group::rwx          #effective:rw-
group:www:r-x           #effective:r--
group:www-devs:rwx      #effective:rw-
mask::rw-
other::rw-

This shows that on the file that was just created, www has only read access, while www-devs has read and write. Note that I ran the touch command as root, so root is the one who actually owns the file. But because of the ACL, that has no impact on what the www and www-data groups can do to the file.

  • Thank you for your reply. Is this the standard practice for corporate or other such Apache web servers? I would be curious to know how such access rights are usually managed for servers which are used by a number of developers. – Ambulare Sep 25 '14 at 23:05
  • No. Standard practice is that developers never work directly on the production web server. They commit their code into a version control system, and then that code is checked out from version control onto the server (or deployed as a package of some sort, like a tarball). – Patrick Sep 25 '14 at 23:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.