2

I've been learning the Linux OS over the last year or so and I am still very confused on how permissions vary from different configurations. I am trying to set up my local development environment and in so doing I notice that on the production VPS (CentOS), my file/directory permissions behave differently than my local setup (Mint).

The remote server file structure has been set up where owner and group are myuser:myuser and rwx permissions are set to 755 for directories and 644 for files which works fine with the website's requirements. However, I have to change ownership to www-data:www-data and permissions on some folders to 777 in order to have it work the same locally. I've added myuser to the Apache group but the problem persists.

That leads me to believe that my local shell user differs from my local Apache user, and that on the remote system, the shell and Apache users are the same. Is this right?

I'm concerned about the security implications of changing these settings. I've read that you shouldn't give the web server write access. However, drupal requires it on the file repository dir called "files" and although the remote system files are owned by myuser:myuser (and if that user is the Apache user) then doesn't that mean the web server still has write access?

So then what determines how these users should be set up? I assume that I'll be changing the Apache run user and or group but could someone explain the method and best practices for doing so? Should the same rules apply for local vs remote?

1

You are basically asking two separate questions.

  1. How to set permissions on your local system to mirror the production one?

    You need to know the server configuration - in this case it includes configuration of the http daemon (httpd aka Apache in this case) - usually found in /etc/httpd or /etc/apache). You also need to know with what credentials daemon runs. Then you should be able to set your local permissions either in exactly the same way or effectively in the same way (i.e. different user/group names but same access rights when the daemon asks for a file),

  2. Are write permissions for a HTTP deamon ok?

    Depends. Generally the less writing a daemon can do the better. On the other hand in most cases (unless serving static/read-only content) it is not viable. If that is the case, several ways of hardening the system are at hand:

    1. run the daemon under a special user which will only have read access to the document root and write access only where necessary (extended ACL utilities getfacl/setfacl are your friends). On Linux you may also employ additional security models (GRSecurity/SELinux/AppArmor/...).

    2. properly written data handling - sane treatment of bogus input. In this case "sane" means "do not write anything".

    3. write access through a "proxy" - have the executive part (the model in the often used MVC model in a separate process won't hurt security-wise (but has to be implemented properly to be of any benefit).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.