1

I am fairly Apache2 savy, but have been tasked at my job to do the following;

Server currently has two vhosts. (Two totally separate clients) I was asked if I could create a user account by which the one of the clients would be able to have basically jailed FTP or SFTP (preferably) access only to their files.

The way the vhosts are currently laid out is that they both reside in; (client1 & 2 are obviously pseudonyms for the real names) /home/web/client1, and /home/web/public_html (client2) NOTE: All directories just listed are all web:web for owner:group. (I know this is going to have to change to achieve my desired outcome.)

My thoughts were to create a new user (call it, client1) and move their webroot to /home/client1/public_html and then set them up with an rssh account so that they can SFTP into their stuff only.

Where things start to get a bit more complicated for me is now I will have two different user accounts owning their respective web content directories and files and need Apache to be able to work for both, plus allowing that jailed access for the one client.

So, How do I set up each vhost so that the web server will serve up both sites? Do I need to do a chown client1:www-data in client1's public_html dir as well as chown client2:www-data or am I not even on the right track here?

As you can see, the problem actually is multi-faceted. So, try to be as verbose as possible with relation to both the vhost issue and the jailing issue.

Thanks folks.

8
  • Does Apache need modify? And what privilege set are these files coming in with? Unless the files are coming in without world-readable permissions, no adjustment should be needed. Dec 16, 2011 at 17:13
  • Not sure exactly what you're asking, but I'm assuming that you're referring to the permissions they will be set to upon transfer from the user. If that's what you meant then they'll have a umask set to 022 for resulting file perms of 644 and resulting dir perms of 755.
    – Skittles
    Dec 16, 2011 at 17:43
  • Right - so, unless the Apache process needs to write to those files, then I see no reason to change the owner user or group to www-data, since it should have all it needs with the 'others' permissions. Apache should work fine, it has no interest in owning the files as long as it has the permission to do what it needs to do, you should be able to focus on making the permissions support the FTP needs. Dec 16, 2011 at 17:50
  • Well, that might be an issue. I know that one of the clients has a word press installation, which unless I'm mistaken, I believe that it requires some directories to be writable. Ultimately, I want the user to have the access they need to be able to install stuff like word press or an ecommerce package (as will be the case in this instance) which they also usually expect certain writeable directories. You still think this will work?
    – Skittles
    Dec 16, 2011 at 17:55
  • If they do need write, then yeah, you would need to look at messing with ownership. Dec 16, 2011 at 18:07

2 Answers 2

0

If this is a real issue for you (I'm not certain that it is though because Apache effectively 'jails' access via normal directives per vhost). But if you really want to nail the issue once and for all, you may consider using aliased IPs and totally separate apache instances bound to their respective IPs only. For example, client 1's apache is bound to IP address 192.168.0.11:80 (eth0:0), and client 2 goes to 192.168.0.12:80 (eth0:1), etc.

This will work, and it'll allow you totally separate those instances and do whatever you want. Hope this helps.

1
  • Well, I'm not entirely sure what Apache is doing in the background, but interestingly, when I create a virtual host that is pointed at a user's public_html directory located in their /home/user/public_html, Apache seems to be fine with serving the index.php file up. I wish I understood how that's possible.
    – Skittles
    Dec 19, 2011 at 17:49
1

I just checked the Apache httpd 2.2 documentation.

It seems there is no "User" directive per vhost. The only thing that comes near that idea is the "SuexecUserGroup" directive. But that only woks for cgis.

3
  • Yeah...I saw that also.
    – Skittles
    Dec 19, 2011 at 17:45
  • Well, I'm not entirely sure what Apache is doing in the background, but interestingly, when I create a virtual host that is pointed at a user's public_html directory located in their /home/user/public_html, Apache seems to be fine with serving the index.php file up. I wish I understood how that's possible.
    – Skittles
    Dec 19, 2011 at 17:48
  • Apache is running as www-data, yet it's serving up content from directories owned & grouped as anything but that.
    – Skittles
    Dec 19, 2011 at 18:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .