Apache Server setup issue

Question

I have installed and configured apache on RedHat 7 Image on AWS. But I have issues with permissions/ownership while uploading files by ssh using filezilla.

I Setup a ssh user and added its home dir to apache /var/www/html/ and installed Magento on it.

Original Setup:

1. User:Group of /var/www/html/ is apache
2. User: root / Group: apache for /var/lib/php/session dir(not sure but I think magento stores session files there as well as i get write error when owner is changed)
3. httpd.conf User:Group is apache
4. With these settings, cannot upload files with ftp or sftp - permission error.

When I changed to:

1. User:Group of /var/www/html/ is ssh_user
2. User: ssh_user / Group: ssh_user for /var/lib/php/session dir
3. httpd.conf User:Group is ssh_user
4. With these, i was able to upload but cache files are generated as root.

What I want is:

1. User:Group of /var/www/html/ is ssh_user
2. Default settings for /var/lib/php/session dir
3. httpd.conf User:Group is apache

I want to be able to upload files through ftp or sftp by regular user.

How do i acheive this? This is the first time i have setup apache so just trying to learn how to do it right way.

Answer 1

Any web application that requires all directories and files to be writable by the webserver uid is broken and insecure by design. If you are happy to live with that...

1. Provision a new group to encompass every account which should be able to write files - for the sake of illustration I'll call it webwriters

2. Add those users to that group - it doesn't need to be their primary group (usermod -G webwriters ssh_user ; usermod -G webwriters apache ; ....)

3. On each top level directory which is on scope, run these:

chown -R apache:webwriters $DIR
find $DIR -type f -exec chmod g+rw {} \;
find $DIR -type d -exec chmod g+rws {} \;

Now all the files and directories are writeable by the group. AND when you create a new file, it will be owned by the webwriters group.

4. Edit /etc/ssh/sshd_config to add -u 002 after sftpserver and restart sshd. This will ensure that new files copied via sftp will be writeable by the group. Don't use FTP. If you want to use scp you'll need to set the umask in the shell rc file).

5. Create a new directory (if it doesn't already exist) at /etc/systemd/system/httpd.service.d Add a file - you can call it whatever you would like - containing:

[Service]
UMask=0002

then restart apache. This will ensure that files created by the webserver also get the intended ownership / permissions.

Finally, and most importantly, install a HIDS (L5, LIDS, Tripwire) and learn how to manage it. Install fail2ban and add limits on logon attempt rates.

Answer 2

Please check your apache httpd.conf. There you can see ServerRoot and ServerAdmin as well. There, you will be having:

ServerRoot "/etc/httpd"
ServerAdmin root@localhost

Access permissions to server installation or configuration must be root as shown above and not suggested to modify.

But, For docroot location which usually /var/www/html, User and group will be apache. It can be changed to any other user except root. It is important to change the owner for docroot or DocumentRoot directory location which is /var/www/ or /var/www/html with either apache or any other not root user. You can change it to user of your choice. root is not suggested to set as user and group in httpd.conf

User apache
Group apache

make sure you must change the owner of docroot directory with the same user as mentioned in httpd.conf.By default the user and group are apache. So, you will need to change the owner of docroot directory /var/www/html to apache as shown below:

sudo chown -vR apache. /var/www/html

Now your website pages will start to create cache whenever you visit a webpage loaded by apache.

In your scenario, As you are using and ssh_user as user, You can set User:Group your desired directory location and all its internal hierarchy, for.eg., for the path /var/www/html/, then you can make it with below command.

Syntax: sudo chown -vR username:groupname {path-of-directory-location}

sudo chown -vR ssh_user:ssh_user /var/www/html
sudo chown -vR apache:apache /var/lib/php/session

If you want to be able to upload or transfer files through ftp or sftp by regular user., You can use any of either FileZilla Server or WinSCP, it is suggested to login with the user owning the directory and then transfer the files.

Make sure if you have either user or group permissions to the directory you are trying to access.