4

I constantly have problems with read & write & execute permissions by Apache/me. There is a user "konrad" (it's me) in "konrad" group, and there is a user "www-data" in "www-data" group used by Apache. When I ("konrad") create a directory, then Apache have no rights to write to this folder which causes problems.

So now I have the following "idea": I will add myself ("konrad" user) to the "www-data" group (where also Apache's user belongs) and then I chown all my www projects, so that they will belong to user "konrad" but group: "www-data". And I will chmod the projects so that this group will have all permissions to files and directories (I think that would be 770).

Then I will change my primary group from "konrad" to "www-data", so everytime I'll create a new directory/file Apache will also have a full access to it.

The question is: is this a good idea? I don't have a great experience with permissions or even Unix itself. So maybe I'm missing something. But it seems reasonable to me.

Improve this question
0

3 Answers 3

Reset to default
2

Apache runs as a non-privileged user known as www-data in Debian distros for quite a very good reason: security.

It is considered a good security practice when dealing with daemons giving up privilege rights, avoiding as much as possible to create configuration files or data files with the ownership of the non-privileged user that runs the daemon - as such, if the Apache user is compromised, the attackers will have a much more hard time to mess around things or deface a site.

As possible, I recommend to create sites with different users, and to give read rights to the www-data group only; and to have only write access to www-data in directories that really need them. However even this can be avoided using mod-ruid2.

mod-ruid2 allows actually to run each site/vhost with their owner, and dealing with the security model of pages is much easier. It takes out the necessity of creating world writable directories. It also guarantees that in case of a compromise of one vhost, the attacker is not able to plant malware in the other vhosts.

mod-ruid2 is also advised for people with a hosting model, and we use it here to run a few hundreds sites, with quite success.

Unfortunately, the documentation about mod-ruid2 is a bit scant, and I had to write a more elaborate post to describe it here in Unix and Linux.

Improve this answer
2
  • Thank you @Rui. Apparently I have a lot of reading to do:)
    – konrad_firm
    Commented Mar 10, 2016 at 14:29
  • You are welcome, enjoy and keep up the good work.
    – Rui F Ribeiro
    Commented Mar 10, 2016 at 14:30
2

I think you miss-configured apache. I would really have my projects and files with konrad permissions, so that my code is safe in case of vulnerability in some "CGI" script. Your web server should be fine on reading your files (if they are world readable). You need the superuser only to configure apache to read one directory owned by you, or to create/change owner of a directory served by apache.

You eventually need one or two directories writable by the web server/www-data, but this is an other issue.

Improve this answer
1
  • -thanks. Looks like my "idea" is not that cool as I thought:)
    – konrad_firm
    Commented Mar 10, 2016 at 14:22
1

I have learned that you should always use seperate users for Webserver. That's what i learned from my teacher - Because of security reasons you should always use different users for different things. BTW, ich chown www-data:www-data is typed in seconds :P

But which files are you creating as "konrad" and why does www-data have access to it? I run 2 webserver and when I'm creating some files which are meant to be for www-data, I su - www-data and then I create them.

So it is a very untypical situation you have here :P

Improve this answer
8
  • 2
    www-data is not supposed to have an active shell, how do you su to it?
    – Rui F Ribeiro
    Commented Mar 10, 2016 at 13:56
  • 1
    @RuiFRibeiro I dont know why you say it is not supposed, i just made i fresh install of an LAMP server without changing any configuration, i can act as www-data if I do a su - www-data. I can create Files with it, manipulate files which i have created. I am also really new to it so i didn't know the case that i can't su to it. @ konrad okay, my idea only works when you don't need it frequently like me, i think my idea is the standart way to setup some sites and application running on an LAMP server.
    – SystemCookie
    Commented Mar 10, 2016 at 15:10
  • 1
    All my Apache servers have the www-data user with /usr/sbin/nologin as the login shell. I wont give a bash shell to a daemon user.
    – Rui F Ribeiro
    Commented Mar 10, 2016 at 15:19
  • 1
    I think we are not in the same distro...my default would be /bin/bash for users. I will check it home, my baseline VMs at work have all been changed a lot. Nevertheless, I will never ever give a bash to www-data.
    – Rui F Ribeiro
    Commented Mar 10, 2016 at 15:23
  • 2
    @RuiFRibeiro I checked it with Debian. But i think it is a good idea to give www-data nologin .. never thought about it. (With never i mean the 4months i am working as sysadmin)
    – SystemCookie
    Commented Mar 10, 2016 at 15:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .