I have set up a LAMP-server using ISPConfig 3 for the administration. PHP is running over Fast-CGI.
I have several domains, like my_site.com, my_site.net and my_site.org, but they all point to the same application/website. Each domain has its own web-root-folder and is running under its own user. The application itself is in a common directory which is owned by another user, like so:
# path to my_application (owned by web1)
/var/www/clients/client1/web1/web/my_application/
# sym-link to my_application from my_site.com-web-root (owned by web5)
/var/www/my_site.com/web -> /var/www/clients/client1/web1/web/
# sym-link to my_application from my_site.net (owned by web4)
/var/www/my_site.net/web -> /var/www/clients/client1/web1/web/
With a setup like this I have encountered a few problems concerning the permissions when performing filesystem-operations with PHP. For instance, if the application is called via my_site.com, the user web5
is trying to write something to the application-folder. But the application-folder is owned by the user web1
, so web5
is not allowed to write there.
As far as I unterstand, this is how Fast-CGI works.
After some research and asking a few people, the solution seems to be to break it all down to one domain (e.g. my_site.com) and define the other domains (my_site.org, my_site.net) as alias for this one domain. That way, there would be only one user who has all necessary permissions.
However, this would mean that we'd have to buy a multidomain SSL-certificate - but we already have an SSL-certificate for each domain. We were able to use them with our previous provider (managed hosting), and there we also had only one web-directory and multiple domains.
So if this was possible, I wonder: Is putting all the domains together into one v-host with one main- and several alias-domains the right approach in this case? Or may I have misunderstood something?
client1
) and I've already sort of "patched" the problem for the necessary directories withchown -R g+rwx dir/
, but I'm not sure if this is really the solution since those permissions did not work in every case and they also are different from what we had before with our old hosting provider (and it worked fine with those permissions). I'm not too familiar with this and I'm afraid I migh tear a security hole in my application without noticing it... Or is it ok to have permissive group settings?