Apache - how to serve pages with users other than www-data

Question

I have a webserver that uses apache. When I do a ls -l on /var/www/project1/public_html and /var/www/project2/public_html, I see that they are owned by projectuser1 and projectuser2 respectively.

On some of other servers I've looked at, both /var/www/project1/public_html and /var/www/project2/public_html are owned by only www-data. How would I go about changing these ownerships to projectuser1 and projectuser2 such that these new users can login to their areas and manage their own websites?

I created a user projectuser1 then did a chown -R projectuser1 /var/www/project1, but any time projectuser1 adds a new file to the directory, Apache gives me a Permission Error. If do a chown -R www-data /var/www/project1, then everything works again.

Ultimately, I want apache to serve the /var/www/project1 directory with projectuser1 owning it.

Answer 1

There a two simple answers for your question:

1. You could add the www-data group to each projectuser with usermod -aG www-data projectuser% and then ensure that group permissions are at least g+rw with chown -R g+rw /path/to/dir.

2. There is a module that runs each child process as a different user called mpm-itk. This allows you to run each vhost under a separate userid.

Answer 2

Having the served files owned by the server uid (www-data) is often a bad idea. The server should be able to server files owned by other users. You just must make sure the permission bits on the files allow that.

So, instead of:

chown -R www-data /var/www/project1

which changes owner of the files. And you don't want the server to be owner of those files, unless the server is supposed to write them.

You should rather do:

chmod -R a+rX /var/www/project1

which will set read permission to all files and execute permission to all directories under /var/www/project1. This will make the files read-accessible by anyone. Make sure it is ok. If other users are not supposed to be able to read these files, then this answer is not for you.

You could also use a group for the HTTP server and the users who are allowed to upload files for it. This will make things a bit more complicated.

Another problem are the permission of the files uploaded by your users. The thing that matters is 'umask' – setting stating which permission bits should be disabled for newly created files. How to change that depends on how the files are uploaded (FTP, ssh session, scp, anything else). The files are probably uploaded with umask 0077 or 0007 now, which means any permission only for the owner of the files (the one who uploads them) and maybe his gid.